Install an SSL Certificate onto SilverStream. Sender Recipient Attached FIles Pages Date. Development Internal/External None 5 6/16/08

Transcription

1 Technical Note Sender Recipient Attached FIles Pages Date Development Internal/External None 5 6/16/08 This technical note explains how to generate a Certificate Signing Request (CSR) and install an SSL certificate onto SilverStream. It contains the following topics: Topic Page Generating the CSR 1 Certificate Enrollment 3 Installing the Certificate 4 Logging into the DataView Portal 5 Generating the CSR To generate a Certificate Signing Request (CSR): 1. On the SilverStream server, open a terminal window and change to the silverstream/bin directory for example: cd /opt/silverstream/bin 2. Execute the following command:./agdigitalidstep1 The first page of the Digital ID Wizard Step 1 appears., 6/16/08 1

2 3. Assign values to the fields as shown in the example below, then click Next. 4. The next Wizard page prompts you for the private/public key pair to generate. Specify the appropriate size and click Next. 5. On the next Wizard page, specify your private key password and click Next. You will need this password in Step 5 of section Installing the Certificate., 6/16/08 2

3 6. The wizard displays the names and locations of your CSR and private key. Accept the defaults or specify new names and locations, then click Next. 7. The final Wizard page appears, as shown below. Click Copy CSR to Clipboard, then click Finish. Clicking Copy CSR to Clipboard keeps you from having to navigate to and open the rsa_csr.txt file to copy its contents. You will use the text of the CSR when you perform the certificate enrollment steps in the next section. Certificate Enrollment Before you begin, be sure that the text of the CSR you generated in the previous section is on the clipboard. If it is not, navigate to the file rsa_csr.txt, which was generated in the previous section. Open the file, then select and save its contents. The default location of this file is: /opt/silverstream/digitalid To perform the enrollment: 1. Log into VeriSign s enrollment page at the following address: 2. On the Before You Start page, read the preliminary information, then click Continue. 3. Click Continue on the Step 1 of 5: Generate CSR page. (You have already generated a CSR and have its contents on the clipboard.) 4. On the Step 2 of 5: Submit CSR page, paste the contents of the clipboard into the Enter CSR Information box, then click Continue. 5. Complete the remaining enrollment steps on the VeriSign site. Your certificate will be sent by ., 6/16/08 3

4 Installing the Certificate Perform the following steps after you receive the Digital ID certificate that VeriSign ed to you at the end of the previous section. To install the certificate onto SilverStream: Note: SilverStream must be running during this procedure. 1. Copy the certificate that you received from VeriSign by On the SilverStream server, open a terminal window and change to the silverstream/bin directory for example: cd /opt/silverstream/bin 3. Execute the following command:./agdigitalidstep2 The first page of the Digital ID Wizard Step 2 appears, as shown below: 4. Paste the certificate into the Digital ID box, then press Next. 5. On the next Wizard page, provide the name and location of the private key file and the private key password, then click Next. Note: In section Generating the CSR on page 1, you specified the private key file in Step 6 and the private key password in Step 5., 6/16/08 4

5 6. On the final Wizard page, specify the server name and HTTP port, then click Finish. 7. Dismiss the confirmation message that appears. 8. In the terminal window, stop the SilverStream server and restart it as the root user, as follows: 8-a. Stop the SilverStream server with the following command: /etc/init.d/silverstream stop 8-b. Change to the /etc/init.d directory (cd /etc/init.d) and open the SilverStream file for editing. 8-c. In the SSSUSER field, change the SilverStream user to root, as follows: SSSUSER=root Note: The root user is required to access the default RSA port 443. Only the root user can access ports below d. Save and close the file SilverStream. 8-e. Restart the SilverStream server with the following command: /etc/init.d/silverstream start For more information about installing an SSL certificate on SilverStream, see the SilverStream extend Application Server Administrator s Guide. Logging into the DataView Portal When SilverStream restarts, it listens on the default RSA port of 443. To log into the DataView portal, use HTTPS in the following format: For example: 6/16/08 5