Difference between revisions of "HTTPS Provisioning"
| Line 57: | Line 57: | ||
<br />Example: | <br />Example: | ||
<br />[[File:Sample_command_and_output.png]] | <br />[[File:Sample_command_and_output.png]] | ||
| + | |||
'''6.''' Select the newly created '''.p12''' files in GigaFlow '''Global'''>'''SSL'''. | '''6.''' Select the newly created '''.p12''' files in GigaFlow '''Global'''>'''SSL'''. | ||
Revision as of 10:20, 14 March 2024
SSL certificate generation on GigaFlow
To generate an SSL certificate o GigaFlow, perform the following steps:
1. To change the current directory to the web server one that contains the keystore, on your Linux VM or appliance in the terminal prompt, run the following command:
cd /opt/ros/resources/prepos
Note: You can later make sure that the created files have the same chown/chmod permissions as the previous files, respectively root/root and/or gigaflow/viavi.
|
2. To set the SAN (Subject Alternative Name) field in the CSR (Certificate Signing Request), create or edit the .cnf file as required for the target system. Use the following example to fill the .cnf file.
| Note: You must fill the fields in italic font with company specific information, especially if seen in the certificate creation section on customer side. |
[ req ]default_bits = 2048(another option:4096)distinguished_name = req_distinguished_namereq_extensions = req_ext[ req_distinguished_name ]countryName =Country Name (2 letter code)stateOrProvinceName =State or Province Name (full name)localityName =Locality Name (for example, city)organizationName =Organization Name (for example, company)commonName =Common Name (for example, server FQDN or YOUR name)[ req_ext ]subjectAltName = @alt_names[alt_names]DNS.1 = 5l60p12.ds.jdsu.netDNS.2 = (name without FQDN .com)DNS.3 = (can use the IP)
3. To generate the public/private keypair and CSR using .cnf file, use the following example:
openssl req -out gigaflow1_20240129.csr -newkey rsa:2048 -nodes -keyout gigaflow1_20240129.key -config gigaflow1.cnf
Note: The file created with -keyout command, *.key will be used later.
|
4. Submit the CSR to the CA (Certificate Authority). The CA will generate the cert file.
- Collect the cert file from CA.
- If possible get a complete chain from the customer or create a password protected P12 chain from the CA files, the cert file, and the private key.
- If CA provides a *.pem file that contains all 3 sections, then use that file.
- To create a file with separate .cer files from CA, follow the below example:
cat <signed_cert_filename> <intermediate.cert> [<intermediate2.cert>] > GigaFlow1_20240129_chain.txt{.pem}
5. To create a .p12 certificate used for the server, follow the below example:
openssl pkcs12 -export -in GigaFlow1_20240129_chain.txt -inkey <private_key_filename> -name ‘GigaFlow1_20240129’ -out GigaFlow1_20240129.p12
The command requires the following parameters and will ask (also confirm) for a .p12 password to be created then used later in GigaFlow (no password fails inside GigaFlow):
in - use the certificate from CA .pem or chain of separate .txt files (.pem).
inkey - use the key created above in step 3. (.key).
name - use the DNS name of the server.
out - the name of the files to be used by GigaFlow (.p12).
Example:
6. Select the newly created .p12 files in GigaFlow Global>SSL.
- Update the GigaFlow settings (Settings>Global>SSL) page to point to P12 with the matching password (no password will not work).
| Note: GigaFlow will auto-restart the https listener to immediately use the new certificate. You are not required to manually restart the server and/or the service. |
| Note: The method used here may depend on the format in which the cert(s) are provided by the CA. |
- Install the P12 into the
/opt/ros/resources/preposfolder on the GigaFlow server. - Adjust the file chmod/chown attributes on the P12 to match the previous .p12 file.
