Administer > Configuration > Secure Connections > Configure Secure Connections for Client Browsers > Configure CSA to Create a New Self-Signed Certificate for Global Search

Configure CSA to create a new self-signed certificate for global search

This section describes the process you should follow to create a new self-signed certificate required for global search functionality. These steps are required when a certificate expires, a new certificate is generated, or a self signed certificate is replaced with a CA-signed certificate.

Note In the following instructions,

CSA_HOME is the directory in which CSA is installed

(for example, on Windows the directory is C:\Program Files\HPE\CSA and on Linux the directory is /usr/local/hpe/csa) and the keytool utility is included with the JRE.

Also, the following instructions are applicable for subordinate Certificate Authorities. Wherever the Certificate Authority is mentioned, the subordinate Certificate Authority is implied. For example, if the content states to submit the certificate to a Certificate Authority, you may also submit the certificate to a subordinate Certificate Authority.

To create a new self-signed certificate to send with your request to a Certificate Authority, complete the following steps:

  1. Open a command prompt and change directories to CSA_HOME.

  2. Run the following command to generate a new certificate and keystore:

    Windows:

    "CSA_JRE_HOME\bin\keytool" -genkeypair -alias CSA -validity 365 -keyalg rsa -keysize 2048 -keystore <KEYSTORE> -storetype PKCS12

    Linux:

    CSA_JRE_HOME/bin/keytool -genkeypair -alias CSA -validity 365 -keyalg rsa -keysize 2048 -keystore <KEYSTORE> -storetype PKCS12

    where <KEYSTORE> refers to the keystore location.

    Example:

    Windows:

    "CSA_JR_HOME\bin\keytool" -genkeypair -alias CSA -validity 365 -keyalg rsa -keysize 2048 -keystore .new_keystore -storetype PKCS12

    Linux:

    CSA_JRE_HOME/bin/keytool -genkeypair -alias CSA -validity 365 -keyalg rsa -keysize 2048 -keystore .new_keystore -storetype PKCS12

    You can use different values for -alias, -validity, -keysize and -keystore. These instructions assume that you will use the -alias and -keystore values recommended here. You will need to adjust the commands accordingly if you use different values.

  3. Export the newly generated certificate out of keystore.

    Windows:

    "CSA_JR_HOME\bin\keytool" -exportcert -keystore <KEYSTORE> -alias CSA -file <CERTIFICATE-FILE> -storetype PKCS12

    Linux:

    CSA_JRE_HOME/bin/keytool -exportcert -keystore <KEYSTORE> -alias CSA -file <CERTIFICATE-FILE> -storetype PKCS12

    where <CERTIFICATE-FILE> refers to the filename for the exported certificate.

    Example:

    Windows:

    "CSA_JR_HOME\bin\keytool" -exportcert -keystore <KEYSTORE> -alias CSA -file csasearchcertificate.cert -storetype PKCS12

    Linux:

    CSA_JRE_HOME/bin/keytool -exportcert -keystore <KEYSTORE> -alias CSA -file csasearchcertificate.cert -storetype PKCS12

  4. Import the newly created certificate into the JRE truststore.

    Windows:

    "CSA_JR_HOME\bin\keytool" -importcert -keystore <CSA_JR_HOME>\lib\security\cacerts -file <CERTIFICATE-FILE> -alias <ALIAS-NAME>

    Linux:

    CSA_JRE_HOME/bin/keytool -importcert -keystore <CSA_JR_HOME>\lib\security\cacerts -file <CERTIFICATE-FILE> -alias <ALIAS-NAME>

    Note <ALIAS-NAME> must be used since it does not exist in the JRE cacert truststore. If a similar name exists then delete it first as follows:

    Windows:

    "CSA_JR_HOME\bin\keytool" -delete -alias <ALIAS_NAME> -keystore <CSA_JR_HOME>\lib\security\cacerts

    Linux:

    CSA_JRE_HOME/bin/keytool -delete -alias <ALIAS_NAME> -keystore <CSA_JR_HOME>\lib\security\cacerts

  5. Import the Elasticsearch certificate into the newly created keystore.

    Windows:

    "CSA_JR_HOME\bin\keytool" -importcert -keystore <KEYSTORE> -storetype PKCS12 -file <ELASTIC-SEARCH-CERTIFICATE> -trustcacerts -alias ES

    Example:

    "CSA_JR_HOME\bin\keytool" -importcert -keystore <KEYSTORE> -storetype PKCS12 -file CSA-HOME\elasticsearch-1.6.1\config\es.crt

    Linux:

    CSA_JR_HOME/bin/keytool -importcert -keystore <KEYSTORE> -storetype PKCS12 -file <ELASTIC-SEARCH-CERTIFICATE> -trustcacerts -alias ES

    Example:

    CSA_JR_HOME/bin/keytool -importcert -keystore <KEYSTORE> -storetype PKCS12 -file CSA-HOME/elasticsearch-1.6.1/config/es.crt

    where <ELASTIC-SEARCH-CERTIFICATE> is the location of the elasticsearch certificate file.

  6. Open the CSA_HOME/CSA/csa-search-service/app.json file in a text editor.

  7. Change the following string (there are two occurrences):

    Change: "pfx" : ".keystore"

    To: "pfx": "<KEYSTORE>"

  8. Restart the CSA and HPE Search Service services. See Restart CSA for instructions.

 

Send Help Center feedback