CLIENT CERTIFICATE (EAP-TLS USE)

Transcription

1 PRIMEXIAQ & TEMP SERIES SENSORS CLIENT CERTIFICATE (EAP-TLS USE) SETUP GUIDE Doc Part No.: SNSDOC

2 Legal Notice Copyright 2015 Primex Wireless, Inc. All rights reserved. SNS is a trademark of Primex Wireless, Inc. U.S. Patents 6,873,573; 7,352,657. Other Patents Pending. Printed in the USA. Information in this document is subject to change without notice. The software described in this document is furnished under a license agreement or nondisclosure agreement. The software may be used or copied only in accordance with the terms of those agreements. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical or otherwise, for any purpose, without the prior written permission of Primex Wireless. Contact Primex Wireless United States Canada United Kingdom Address 965 Wells Street 1310 Kerrisdale Blvd. Unit G420 Dean Clough Lake Geneva WI Unit #4 Halifax, West Yorkshire HX3 5AX Newmarket, ON L3Y 8V6 info@primexinc.com info@primexwireless.ca info@primexwireless.co.uk Web primexwireless.co.uk Telephone (800) (800) Fax (262) (905) Primex Wireless Client Certificate (EAP-TLS Use) Setup Guide II

3 CONTENTS About this Guide 4 Overview 5 Requirements 5 Create Active Directory User 5 Request Certificate 5 Export Certificate as.pfx file 6 Convert Certificate to.pem File Format 7 Convert the.pem file to DER key and DER Certificate 7 Support 8 Primex Wireless Client Certificate (EAP-TLS Use) Setup Guide III

4 ABOUT THIS GUIDE Purpose This guide provides the procedures required to create a certificate for use of EAP-TLS authentication with Primex Wireless devices. The file (s) created during these procedures will be uploaded to the devices during their configuration for the network. Models These procedures are to be completed for use with the Primex devices listed below. PrimexTEMP Series Sensors PrimexIAQ Series Sensors Typographical Conventions This guide uses typographical conventions to highlight specific types of information. Typeface Indicates Example Bold Menu sequence or command Click Support Command line input > cd /var/sns/sns-install This guide includes notes, cautions, and warnings content that highlights important messages. Typeface Note Caution Warning Example Indicates Indicates something important or useful. Indicates a command or procedure may have an unwanted or undesirable result. Indicates a command or procedure that could be dangerous to system or device. Provides an example of how the topic can be configured or used. Primex Wireless Client Certificate (EAP-TLS Use) Setup Guide 4

5 OVERVIEW For secure EAP-TLS certificate based authentication, you must create a certificate and then install the certificate file(s) onto the Primex Wireless devices. The certificate is installed during configuring the device for the network. Once a device is configured for the network and operational on your facility s network, it can be managed and monitored from your organization s Application Management Platform (AMP). NOTE: These procedures assume that one multi-use certificate will be deployed for all Primex devices. If your organization requires a unique certificate for each device, this procedure is required to be completed for each single certificate. Requirements Before you begin this procedure, verify below requirements are met. Your facility's IT Infrastructure consists of Microsoft Active Directory integrated with a Cisco ACS and the WLAN. You have Active Directory administrative permission or been delegated the appropriate authority to add user accounts. Your have Administrator privileges on a local domain computer; requires Windows operating system. You have administrative access to the AMP appliance or other another Linux server. General knowledge of Linux is recommended, but is not required. Your organization s AMP is configured and operational on your network. CREATE ACTIVE DIRECTORY USER During this procedure you will create a new unique Active Directory (AD) user account for use with the Primex Wireless devices. 1. Create an AD user that is specific for Primex Wireless devices. The user account is to be a normal account. Do not enable password change on next logon. To uniquely identify Primex Wireless devices, it is recommended the user name is set to PrimexWireless, which will be used as an example throughout these procedures. You will be required to enter the AD user account password during the export certificate procedure. REQUEST CERTIFICATE During this procedure you will request a certificate from your organization s Certificate Authority Server, by use of Microsoft CA. Upon completion of the request, the certificate will be installed on your local computer. NOTE: For Internet Explorer 11, Trusted Sites and Compatibility Viewer is required to be enabled. 1. Open Internet Explorer and log in to your organization s Certificate Authority Server as the new Active Directory user account. For example: 2. Select Download CA Certificate. 3. Name the file CA.der 4. Save it to a location on your local computer. This file is required when configuring a sensor for the network. Primex Wireless Client Certificate (EAP-TLS Use) Setup Guide 5

6 Export Certificate as.pfx file Requirements 5. From the browser, select Home from the upper right portion of the window. 6. Select Request a certificate. 7. Select Advanced Certificate Request. 8. Select Create and submit a request to this CA. 9. From the Certificate Template drop-down, select User. 10. From the Key Size field, enter a value; minimum of 2048 required. 11. Select Mark Keys as exportable. 12. From Request Format, select CMC. 13. From the Hash Algorithm drop-down, select SHA Choose Submit. 15. A new window appears, select Open this Certificate. EXPORT CERTIFICATE AS.PFX FILE During this procedure, you will export the installed certificate as a.pfx file and save it to your computer by use of Microsoft Management Console (MMC). NOTE: Administrator access on the local computer is required to complete this procedure. 1. From your computer's Start menu > select Run or type Run into the search for programs and files field. 2. From the Open command line, enter mmc (Microsoft Management Console) and choose Ok. 3. From the file menu, select Add/Remove Snap-in. 4. Select Certificates. 5. From the left menu, select from My User Account > Certificates Current User; My User Account 6. From the Personal > Certificates folder, select the certificate to export. 7. Right-click on the certificate, select All Tasks and select Export. The Certificate Export Wizard will begin. 8. Select Yes, export the private key and choose Next. 9. Select Personal Information Exchange - PKCS #12.(PFX) Select Include all certificates in the certification path if possible. Deselect Enable strong protection (requires IE 5.0, NT SP4 or above) Deselect Delete the private key if the export is successful 10. Select Next. 11. Enter the password for the AD user account created for the Primex devices. 12. Specify the file name and save the certificate file (.pfx) to your computer desktop. 13. From the Export was successful notification, choose Ok. Primex Wireless Client Certificate (EAP-TLS Use) Setup Guide 6

7 Convert Certificate to.pem File Format Requirements CONVERT CERTIFICATE TO.PEM FILE FORMAT During this procedure, you will copy the exported certificate file to the AMP appliance or another supported Linux server to convert the file to a.pem file format. The.PEM file format is required for Primex Wireless devices use of EAP-TLS authentication. 1. Copy the.pfx file to the Primex Wireless AMP appliance or another Linux server that supports openssl commands. 2. Log in to the server appliance. 3. Change to the directory that has the file and issue the command: openssl pkcs12 -in PrimexWirelessCert.pfx -out PrimexWirelessCert.pem -clcerts nodes 4. Enter your local domain user account password and press enter. 5. Copy the.pem file to a local computer that will be used to configure the devices for the network. 6. The next step is dependent upon the device model as described below. The.PEM file is required to be uploaded to each device when configuring devices for the network. These procedures are located in the device model Installation Guide. CONVERT THE.PEM FILE TO DER KEY AND DER CERTIFICATE NOTE: This procedure is only required to be completed for use with PrimexIAQ and PrimexTEMP Series Sensors. During this procedure, you will create the.der key and certificate files. 1. While still logged into the AMP appliance or another Linux server, issue the command: openssl rsa -in PrimexWirelessCert.pem -outform der -out PrimexWirelessKey.der 2. Issue the command: openssl x509 -in PrimexWirelessCert.pem -outform der -out PrimexWirelessCert.der 3. Copy the two DER files to your local machine to the folder where you had previously saved the CA certificate file (CA.der). The two DER files are required to be uploaded to each sensor when configuring the sensors for the network. These procedures are located in the sensor model Installation Guide. Primex Wireless Client Certificate (EAP-TLS Use) Setup Guide 7

8 SUPPORT Supporting Documentation Additional information is available in the AMP software Support tab. To obtain additional technical documentation for Primex Wireless products, visit the Support area on our Web site ( Technical Support Prime Wireless Technical Support responds to specific questions about product features, system configuration, and troubleshooting. All support services will be delivered in accordance with your organization's support agreement, end user licenses agreements, and warranties. Contact Technical Support Before contacting Primex Wireless Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Customer ID Problem description Device hardware information Error messages Troubleshooting performed before contacting Primex Wireless Recent network changes (SNS products only) Technical Support Telephone (800) Fax (262) Hours 7:00 am to 7:00 pm CST Monday through Friday Web Primex Wireless Client Certificate (EAP-TLS Use) Setup Guide 8