Certificate Installation

Plesk 7 & 8 Certificate Installation

  -----BEGIN CERTIFICATE-----
  MIIEyDCCBDGgAwIBAgIEAgACmzANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJV
  UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMRwwGgYDVQQDExNHVEUgQ3liZXJU
  .....
  zs1x+3QCB9xfFScIUwd21LkG6cJ3UB7KybDCRoGAAK1EqlzWINlVMr5WlvHqvaDj
  vA2AOurM+5pX7XilNj1W6tHndMo0w8+xUengDA==
  -----END CERTIFICATE-----

  -----BEGIN CERTIFICATE-----
  MIIB+jCCAWMCAgGjMA0GCSqGSIb3DQEBBAUAMEUxCzAJBgNVBAYTAlVTMRgwFgYD
  VQQKEw9HVEUgQ29ycG9yYXRpb24xHDAaBgNVBAMTE0dURSBDeWJlclRydXN0IFJv
  .....
  IjeaY8JIILTbcuPI9tl8vrGvU9oUtCG41tWW4/5ODFlitppK+ULdjG+BqXH/9Apy
  bW1EDp3zdHSo1TRJ6V6e6bR64eVaH4QwnNOfpSXY
  -----END CERTIFICATE-----

Using IKEYMAN for Certificate Installation

Comodo send more than one certificate. In addition to the certificate for your server Comodo send an Intermediate CA Certificate (the Comodo certificate) and a Root CA Certificate. Before installing the server certificate, install both of these certificates. Follow the instructions in ‘Storing a CA certificate’.

Note: If the authority who issues the certificate is not a trusted CA in the key database, you must first store the CA certificate and designate the CA as a trusted CA. Then you can receive your CA-signed certificate into the database. You cannot receive a CA-signed certificate from a CA who is not a trusted CA. For instructions see ‘Storing a CA certificate’.

Storing a CA Certificate:

1. Enter IKEYMAN on a command line on UNIX, or start the Key Management utility in the IBM HTTP Server folder on Windows®.
2. Select Key Database File from the main User Interface, select Open.
3. In the Open dialog box, select your key database name. Click OK.
4. In the Password Prompt dialog box, enter your password and click OK.
5. Select Signer Certificates in the Key Database content frame, click the Add button.
6. In the Add CA Certificate from a File dialog box, select the certificate to add or use the Browse option to locate the certificate. Click OK.
7. In the Label dialog box, enter a label name and click OK.

To receive the CA-signed certificate into a key database:

1. Enter IKEYMAN on a command line on UNIX, or start the Key Management utility in the IBM HTTP Server folder on Windows®.
2. Select Key Database File from the main User Interface, select Open.
3. In the Open dialog box, select your key database name. Click OK.
4. In the Password Prompt dialog box, enter your password, click OK.
5. Select Personal Certificates in the Key Database content frame and then click the Receive button.
6. In the Receive Certificate from a File dialog box, select the certificate file. Click OK.

IBM WebSphere Advanced Single Server Edition 4.0

Before being able to enable SSL on WebSphere, you need to have your own certificate. This certificate can be a self-certificate for testing purpose but in any production case, you should have a certificate issued by a Trusted CA. The following steps describe how to get your own certificate and later how to configure WebSphere to use it.

Installing a certificate chain

Before you can add your certificate into the keystore, you must first include the certificates chain. You must install the following public certificates:

You can add the certificates chain from the Signer Certificates screen as shown below:

Click on the Add button. A dialog box will appear where you have to enter the data, the Certificate file name (the certificate file you received) and its location. Once all of this information is entered click on OK.

Installing your site certificate

Once you’ve selected ‘Personal Certificates’, please click on the ‘Receive’ button. A dialog box will appear in which you must enter the data required, the certificate file name (the certificate file you received) and its location. Once all of this information is entered click ‘OK’. This will configure your keystore correctly.

Enabling SSL
Once your keystore has been successfully configured with your certificate, you can enable SSL in WebSphere Application Server.

Step 1. Install the Server file certificate using Key Manager

Go to Key Manager.

Install the new IIS SSL Server certificate by clicking on the key in the www directory (usually a broken key icon with a line through it), and select “Install Key Certificate”.

Enter the Password.

When you are prompted for bindings, add the IP and Port Number. “Any assigned” is acceptable if you do not have any other IIS SSL certificates installed on the web server.
Note: Multiple certificates installed on the same web server will require a separate IP Address for each because SSL does not support host headers.

Go to the Computers menu and select the option “Commit Changes”, or close Key Manager and select “Yes” when prompted to commit changes.

The new IIS SSL Server certificate is now successfully installed.

Back up the Key in Key Manager by clicking on Key menu> Export -> Backup File. Store the backup file on the hard drive AND off the server.

Step 2: Installing the Root & Intermediate Certificates:

Your IIS SSL Certificate will have been emailed to you. The email will also contain two other Certificates: the ROOT certificate and Intermediate CA certificate .Save these Certificates to the desktop of the web server machine.

It is essential that you have installed these two Certificates on the machine running IIS 4. You may also download them from the support section of the website:

Once you have installed the Certificates, restart the machine running IIS 4. You must now complete one of the following procedures – the procedure you follow is dependent on the Service Pack that has been implemented on your machine running IIS4.

Service Pack 3:
Install the above certificates in your Internet Explorer by opening each certificate and clicking “Install Certificate”.

Service Pack 4:
Install the above certificates manually in a specific root store (you may also want to read (see Microsoft Knowledge Base Q194788):

1. Install the Root certificate by double clicking on the corresponding file this will start an installation wizard

2. select Place all certificates in the following store and click browse

3. select Show physical stores

4. select Trusted Root Certification Authorities

5. select Local Computer, click OK

6. back in the wizard, click Next, click Finish

Repeat the same for the Intermediate CA Certificate however choose to place the certificates in the Intermediate Certification Authorities store.

Service Pack 5:
Same as SP4.

Service Pack 6:
Same as SP5.

Reboot the web server to complete the installation.

Installing your Certificate on Java Based Web Servers

You will receive 3 files in a zip file from Comodo.

These must be imported in the correct order:
Root
Intermediate CA
domain/site certificate

Please replace the example keystore name ‘domain.key’ with your keystore name

Use the keytool command to import the certificates as follows:

keytool -import -trustcacerts -alias root -file (ROOT CERTIFICATE FILE NAME) -keystore domain.key

keytool -import -trustcacerts -alias INTER -file (INTERMEDIATE CA FILE NAME) -keystore domain.key

Use the same process for the site certificate using the keytool command, if you are using an alias then please include the alias command in the string. Example:

keytool -import -trustcacerts -alias yyy (where yyy is the alias specified during CSR creation) -file domain.crt -keystore domain.key

EXAMPLE BELOW :

The password is then requested.
Enter keystore password: (This is the one used during CSR creation)
The following information will be displayed about the certificate and you will be asked if you want to trust it (the default is no so type ‘y’ or ‘yes’):
Owner: CN= Root, O=Root, C=US
Issuer: CN=Root, O=Root, C=US
Serial number: 111111111111
Valid from: Fri JAN 01 23:01:00 GMT 1990 until: Thu JAN 01 23:59:00 GMT 2050
Certificate fingerprints:
MD5: D1:E7:F0:B2:A3:C5:7D:61:67:F0:04:CD:43:D3:BA:58
SHA1: B6:GE:DE:9E:4C:4E:9F:6F:D8:86:17:57:9D:D3:91:BC:65:A6:89:64
Trust this certificate? [no]:

Then an information message will display as follows:
Certificate was added to keystore

All the certificates are now loaded and the correct root certificate will be presented.

IBM-Lotus Domino Go 4.6.2.6+ Certificate Installation

Installing your Web Server Certificate

Your certificate will be sent to you by email. The email message includes the web server certificate that you purchased in the body of the email message. Copy the certificate from the body of the email and paste it into a text editor (such as notepad) to create text files. Name this file “Server.txt”.

Installing the Root and Intermediate Certificates

Create 2 text files. The first file should be the Root Certificate. Name this file “root.txt”. The second file should be the Intermediate CA Name this file “inter.txt”.

Note: Be sure to include the —–BEGIN CERTIFICATE—– line and the ——END CERTIFICATE—– line. < p password. the for prompted be will You keyfile.kyr). (usually file of name Type file. ring key existing an open to O Select mkkf typing by utility MKKF Start>

Note: If you start the ‘mkkf’ utility from the directory that contains your certificates you will not need to include the path.

Select R to receive a certificate into the Key Ring File
You will be prompted for the file name. Enter root.txt
Enter Root certificate name (the file name supplied on the file) for the label
Press ‘Enter’ to continue
Select W to work with Keys and Certificates
Select L to List/Select the key to work with
Find the entry you made above (the file name supplied on the file) and select S to select this menu
Select T to mark this as a ‘Trusted’ root
Select Y – Yes, to confirm this request
Press ‘Enter’ to return to the pervious menu
Select X to exit the menu

Repeat from ‘Select R’ using the Comodo Intermediate certificate
Substitute root.txt with intermediate.txt
Substitute Root certificate name (the file name supplied on the file) with Intermediate CA certificate name (the file name supplied on the file)

Installing your Web Server Certificate

From the main menu of the mkkf utility, select R to Receive a certificate into a Key Ring File
Enter the server certificate file name (eg. “server.txt”)
Select W to Work with keys and certificates
Select L to List/Select the key to work with. Select N until you find the required file
Select S to Select this certificate
Select F to mark this key as the selected default key
Select X to exit this menu
Select C to Create a ‘stash file’ for the key ring
Note: This is an important step, which is often overlooked
Select X to exit the menu
Select Y – Yes, to save all changes to the key file and confirm the update

Enabling SSL on your Domino Go Web Server

Access the web server via your browser. Select ‘Configuration and Administration Forms’
Scroll down to security. Select Security Configuration
Ensure ‘Allow SSL connections using port 443’ is selected
Ensure that the correct Key Ring file is listed
Apply the changes

You will then need to restart your Web Server

Installing the certificates on Lotus Domino Server requires the certificates to be merged into the Key Ring file.

This process must be completed for both root certificates provided.

• In Notes, from the administration panel, click System Databases and choose Open Domino Server Certificate Administration (CERTSRV.NSF) on the local machine.

• Click Install trusted root Certificate into Key Ring (option 3).

• Enter the file name for the Key Ring that will store this certificate. The Key Ring file was created when you created the server Certificate Signing Request.

• Select the correct certificate file from the zip file that was sent to you by email.

• Select File in the “Certificate Source” field. Enter the file name in the file name field.

You will need to import the certificates in the below order

1. 1. Root Certificate (supplied in zip file)

• Intermediate CA Certificate (supplied in zip file)

• Click “Merge Certificate into Key Ring.”

• Enter the password for the server key ring file and click OK to approve the merge.

Once all of the root certificates are installed you will need to install the site certificate following the below instructions

• Click Install Certificate into Key Ring (Option 4).

• Enter the file name for the Key Ring that will store this certificate. The Key Ring file was created when you created the server Certificate Signing Request.

• Detach the file from the email to your hard drive and unzip it.

• Select File in the “Certificate Source” field. Enter the file name in the file name field.

• Click “Merge Certificate into Key Ring.”

• Enter the password for the server key ring file and click OK to approve the merge.

2. Start Internet Services Manager

3. Open the properties window for the website. You can do this by right clicking on the Default Website and selecting Properties from the menu

4. Open Directory Security by right clicking on the Directory Security tab

5. Click Server Certificate. The following Wizard will appear:

6. Choose to Process the Pending Request and Install the Certificate. Click Next

7. Enter the location of your IIS SSL certificate (you may also browse to locate your IIS SSL certificate), and then click Next

8. Read the summary screen to be sure that you are processing the correct certificate, and then click Next

9. You will see a confirmation screen. When you have read this information, click Next

10. You now have an IIS SSL server certificate installed

Important: You must now restart the computer to complete the install

If you need to install the Root and Intermediate certificates manually, please see manual installation of Root and Intermediate Certificates

Install to Web Server

Assign to Website

Installation Instructions for Microsoft ISA 2000 Server

How to setup Internet Security and Acceleration Server to Host Web Sites by using the Secure Sockets Layer (SSL) Protocol. This information applies to: Microsoft Internet Security and Acceleration Server 2000

You must first export the SSL certificate of the Web site with the associated Private Key. If you do not have this key, ISA server will not allow you to use this certificate for SSL:
Open a blank Microsoft Management Console (MMC).
Add the Certificates snap-in.
When requested, select the options for ‘Computer Account’ and ‘Local Computer’.
Expand Personal, and then expand Certificates. You should see a certificate with the name of your Web site in the ‘Issued To’ column.
Right-click on the certificate, select All Tasks, and then select Export.
On the Export window, click Next.
Click Yes, ensure you select ‘export the private key’, and then click Next.

NOTE: If you do not have the option to export the Private key then the private key has already been exported to another computer or the key never existed on this computer. You cannot use this certificate on ISA Server. You must request a new certificate for this site for ISA Server.

Select the option for ‘Personal Information Exchange’, and then click to select the appropriate check boxes for all three sub-options.
Assign a password and confirm it.
Assign a file name and location.
Click Finish.

NOTE: Ensure that you keep the file safe the SSL protocol depends upon this file.

Copy the file that you created to ISA Server.
On the ISA Server, open the MMC:
Add the Certificate snap-in, as previously instructed.
Click the Personal folder.
Right-click All Tasks, and then click Import.
Click Next on the Import Wizard.
Ensure that your file is listed, and then click Next.
Enter the password for the file (created earlier).
On the sub-option, click to select the ‘Mark the private key as exportable’ check box.
Leave the import setting on ‘Automatically’, and then click Next. Click Finish.

Now you will need to import the root and intermediate certificates.

Click the Start Button then select Run and type mmc
Click File and select Add/Remove Snap in
Select Add, select Certificates from the Add Standalone Snap-in box and click Add
Select Computer Account and click Finish
Close the Add Standalone Snap-in box, click OK in the Add/Remove Snap in
Return to the MMC
To install the Root Certificate supplied in the zip file:
Right click the Trusted Root Certification Authorities, select All Tasks, and select Import.
Click Next.
Locate the Root Certificate and click Next.
When the wizard is completed, click Finish.
To install the Intermediate CA Certificate:
Right click the Intermediate Certification Authorities, select All Tasks, and select Import.
Complete the import wizard again, but this time selecting the Intermediate CA Certificate when prompted for the Certificate file.
Ensure that the Root certificate appears under Trusted Root Certification Authorities and the Intermediate CA file appears under
Intermediate Certification Authorities.

Important: You must now restart the computer to complete the install.

Under the Personal folder, when a subfolder called ‘Certificates’ is displayed, click Certificates and verify that there is a certificate with the name of the Web computer.
Right-click the certificate and then click Properties.
If the ‘Intended Purposes’ field of the certificate is set to ‘All’ rather than a list of specific purposes, the following steps must be followed before the certificate can be recognized by ISA Server:
In the Certificate Services snap-in, open the Properties dialog box of the relevant certificate. Change the Enable all purposes for this certificate option to the Enable only the following purposes option, select all of the items, and then click Apply.
Open the ISA Manager and complete the SSL install:
Right-click the server accepting the incoming connection, and click Properties.
Click the Incoming Web Requests tab.
Click the Internet Protocol (IP) address entry for the site that you are going to host, or the ‘all IP addresses’ entry if you do not have individual IP addresses set up.
Click Edit.
Click to select the Use a server certificate to authenticate to web users check box.
Click Select.
Select your previously imported certificate.
Click OK.
Click to select the Enable SSL listeners check box.
Expand the ‘Publishing’ folder and click on Web Publishing Rules.
Double click on the Web Publishing Rule that will route the SSL traffic.
On the Bridging tab, choose the option to Redirect SSL requests as: ‘HTTP requests (terminate the secure channel at the proxy)’. Click OK.

Restart ISA Server. (note this means a reboot of the server itself not a service restart)

Installing the Root and Intermediate Certificates

If you have any problems with the installation of your certificate on IIS 4x, check you have installed the root and intermediate certificates

Certificate Installation

1. Open Internet Services Manager from your Administrative Tools.
2. Open the Properties for the Web Site that is hosting OWA (normally the Default Web Site).
3. Select the “Directory Security” tab and then click on the “Server Certificates” button.
4. You will now be presented with the “Pending Certificate Request” dialogue box (below), select “Process the pending request and install the certificate“, click Next.

   

5. The “Process a Pending Request” dialogue box will appear (below), navigate to the site certificate that you received. click Next.

   

6. You will now be presented with the “Certificate Summary” (below), click Next.

   

7. Next you will need to install the intermediate certificate, please follow the instructions :
   

1. Using the Internet Services Manager, open the properties for the “Exchange” virtual directory.

   

2. Select the “Directory Security” tab and the click on the “Edit” button in the Secure Communication section.
3. In the “Secure Communications” dialogue box (below), check the box “Require Secure Channel (SSL)“, you could also check the box “Require 128-bit encryption“, if you do check the 128-bit checkbox, any browsers that do not support 128-bit encryption will be unable to connect to OWA.

Please see the Microsoft article regarding forcing the use of SSL with OWA

One final step that you may need to take is to ensure that your Firewall is configured to allow HTTPS (port 443 by default) to pass through.

Installing the Root and Intermediate Certificates

If you have any problems with the installation of your certificate on IIS 4x, check you have installed the root and intermediate certificates correctly, by following the instructions here: https://support.comodo.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=487

uploading certificate parts

if you have already obtained a certificate containing private key and certificate part (and may be ca certificate), follow these steps to upload it:

1. at the certificate repository page, click on the add button. you will be taken to the ssl certificate creation page.

2. in the upload certificate files section of the page, use the browse button to locate the appropriate certificate file or a required certificate part.

3. click send file. this will upload your certificate parts to the repository.

you can upload an existing certificate in two ways:

1. choose a file from the local network and click on the send file button (.txt files only).

2. type in or paste the certificate text and private key into the text fields and click on the send text button.

uploading a ca certificate

the intermediate ca certificate or rootchain certificate is used to appropriately identify and authenticate the certificate authority, which has issued your ssl certificate. to upload your ca certificate, follow these steps:

1. at the certificate repository page, select a certificate from the list. you will be taken to the ssl certificate properties page.

2. use the browse button, within the section related to the certificate uploading, to locate the appropriate intermediate ca certificate file.

3. click send file. this will upload your ca certificate to the repository.

you can upload an existing certificate in two ways:

1. choose a file from the local network and click on the send file button (.txt files only).

2. type in or paste the ca certificate text into the text field and click on the send text button.

note: when you add a certificate, it is not installed automatically onto the domain or assigned to an ip address, but only added to the certificate repository. you can assign a certificate to an ip address at the client’s ip pool, at the ip aliasing management page, and during hosting creation on an exclusively granted ip.