Creating And Replacing Ssl Certificates; Creating A New Self-Signed Certificate - HP 800 User Manual

System Administration

Creating and Replacing SSL Certificates

NOTE:
15-26

Creating and Replacing SSL Certificates

The Secure Sockets Layer (SSL) protocol uses encryption by way of certifi-
cates to provide security for data or information sent over HTTP.
Certificates are digitally signed statements that verify the authenticity of a
server for security purposes. They use two keys; one public key to encrypt
information and one private key to decipher that information.
keytool is a key and certificate management utility that allows you to create
your own public and private keys when you use self-authentication. These
keys and certificates are stored in a keystore file.
All of the steps in these sections ("Creating a New Self-signed Certificate,"
and "Using an SSL Certificate from a known Certificate Authority (CA)" in the
users guide) should be performed on the MS and each ES.
In order to avoid SSL certificate warnings in the browser when connecting to
the NAC 800 server (either as a NAC 800 user interface user, or from a
redirected endpoint) you will need to install SSL certificates that have been
signed by a Certificate Authority (CA) recognized by the browser, such as
Thawte, Verisign, or your organization's own local SSL CA. To install certifi-
cates, follow the steps below for the MS and each ES. (Once is sufficient for
single-server installations.) Start by removing your existing keystore and
generating a new self-signed certificate as described in "Creating a New Self-
signed Certificate" on page 15-26, using compliance as the alias wherever a
key alias is needed. Once you've generated a self-signed certificate with the
fully-qualified Domain Name of your server, continue with the instructions for
"Using an SSL Certificate from a known Certificate Authority (CA)" on page
15-28.

Creating a New Self-signed Certificate

To generate a private keystore containing a new private key/public certificate
pair:
Command line window
1. Log in as root to the NAC 800 server via SSH.