Administer > Hardening > Use TLS in OMi > Establish trust in the browser

Establish trust in the browser

When a session is started between the browser and the gateway server, the gateway server’s web server sends the browser a server-side certificate that was issued by a Certification Authority (CA). If the certificate used by the web server is issued by a known CA, the certificate can generally be validated by the browser and no configuration is required. However, if the CA is not trusted by the browser, the browser machine must be configured to validate the server-side certificate that is sent. For instructions on setting CA certificate recognition in the browser and configuring browser certificate validation, see your browser vendor documentation.

To import the CA certificate to the truststore used by the browser, complete the following steps:

  1. Make sure the web browser is configured to support TLS.
  2. Export the CA certificate from the OMi certificate store:

    opr-cert-mgmt -export "OMi Webserver CA Certificate" PEM "ca_certificate.crt"

  3. Import the CA certificate to the browser's certificate store:

    • Internet Explorer: Double-click the CA certificate file (C:\ca_certificate.crt, for example) and click Install Certificate. Make sure to select the Trusted Root Certification Authorities certificate store.

    • Firefox: Navigate to Options > Advanced > Certificates. Click View Certificates and then Import. In the Certificate Manager dialog box, select the Authorities tab and click Import.

  4. Import the CA certificate to the truststore of the browser's JRE:

    1. Open the Java Control Panel. Open the Security tab and click Manage Certificates.

    2. In the Certificates dialog box, select the certificate type Secure Site CA and click Import.

  5. Optional. Disable TLS certificate revocation checks in the Java Control Panel.

    The Java console displays the following warning for OMi-generated certificates when the certificate revocation check cannot be performed:

    security: Failing over to CRLs: Certificate does not specify OCSP responder
    security: Revocation Status Unknown

    To avoid the warning, generate OMi self-signed certificates with an OCSP responder URL or disable the TLS certificate revocation checks in the Java Control panel:

    1. Open the Java Control Panel and then open the Advanced tab.

    2. In Perform TLS certificate revocation checks on, click Do not check (not recommended).

    Caution This will disable the revocation check for all TLS connections that are established by Java-based applications on this system.