What is SSL?

    Secure Socket Layer (SSL) is a protocol that encrypts the connection between a client and a server for secure data transfer. To activate SSL on a web server, an SSL certificate is required. This digital certificate verifies the authenticity and integrity of the domain. When SSL is enabled, the URL begins with HTTPS and a padlock symbol appears next to it. Clicking the padlock icon allows you to view the certificate and its details.

    To secure the connection between the ManageEngine SecureAI server and a web browser, you need to apply an SSL certificate to the product.

    Term Description
    Certificate Signing Request (CSR) To receive an SSL certificate, a CSR needs to be created and submitted to a Certificate Authority.
    Certificate Authority (CA) The CA, which is of two types, internal and external, is an entity that verifies all the details mentioned in the CSR, such as the name of the organization, and then issues the certificate. An internal CA is used to create and distribute certificates for internal purposes, such as securing communications within an organization's network. For example, a member server or domain controller in a specific domain that has been assigned the role of a CA. External CAs are third-party vendors, like Comodo, Verisign, and DigiCert, that issue an SSL certificate for your organization.
    Keystore A keystore is a repository that contains the public and private keys required for encryption and decryption of data once a secure connection is established between the client and the server.

    The usual process of obtaining and applying an SSL certificate includes:

    1. Creating a CSR.
    2. Submitting the CSR to your CA.
    3. Binding the CSR with digital signatures provided by the CA.
    4. Applying the certificates to your domain.

    SSL certificate tool in SecureAI

    In SecureAI, the SSL certificate tool enables you to:

    Steps to apply an existing SSL certificate using SecureAI

    1. Log in to SecureAI.
    2. Click the Settings tab. In the left pane, under General Settings, click Connection.
    3. In the Connection Type section, select the HTTPS radio button. The default port number is 9352. You can change the port number in the field next to the HTTPS radio button if you want to use a different port.
    4. Click Save Changes. The change applies only after the product is restarted.
    5. Click the SSL Certificate Tool link next to the HTTPS port field.
    6. Against Select an Option, select the Apply Certificate radio button.
    7. Against Choose Upload Option, select how you want to import the certificate, and fill in the fields that appear below it.
      • ZIP Upload: Select this option if your CA has given you a ZIP file. If your CA has sent you individual certificate files, such as user, intermediary, and root certificates, combine all of them in a ZIP file. In the Upload Certificate (Zip file) field, click Browse and select the ZIP file. If your certificate's private key is password protected, enter its password in the Private Key Passphrase field.
      • Individual Certificate: Select this option if your CA has given you a single certificate file. In the Upload Certificate field, click Browse and select the certificate. Supported formats are .cer, .der, .crt, .pfx, .p12, .pem, .p7b, .jks, and .keystore. In the Upload CA Bundle field, click Browse and select the additional certificate files provided by your CA. If the certificate file is password protected, enter the password in the Certificate Password field.
      • Certificate Content: Select this option if your CA has sent the certificate content as text. Copy the content and paste it in the Paste Certificate Content field. If your certificate's private key is password protected, enter its password in the Private Key Passphrase field.
    8. Click Apply. To clear the fields and start again, click Reset.
    9. Restart SecureAI.

    Note: The certificate password stored in the server.xml file is encrypted by default.

    Steps to generate a CSR in SecureAI and apply the certificate

    Follow steps 1 to 5 in the section above, and then proceed with the steps below.

    1. Against Select an Option, select the Generate Certificate radio button.
    2. Fill in the following fields.
      • Common Name: Enter the name of the server where SecureAI is running. This field is mandatory.
      • SAN Names: Specify the additional hostnames, such as sites, IP addresses, and common names, that must be protected by the certificate.
      • Organizational Unit: Enter the name of the department or the OU that must be specified in the certificate. This field is mandatory.
      • Organization: Enter the legal name of your organization. This field is mandatory.
      • City: Enter the city where your organization is located. This field is mandatory.
      • State/Province: Enter the state or province where your organization is located. This field is mandatory.
      • Country Code: Enter the two-letter code of the country where your organization is located. This field is mandatory.
      • Password: Set a new password to protect the private key of the certificate that SecureAI generates. This password is not issued by your CA, and it is not one of the passwords used in the previous section. Keep a record of it, because you need it again when you apply for the signed certificate. This field is mandatory.
      • Validity (In Days): Enter the number of days the certificate should be valid.
      • Public Key Length (In Bits): Enter the public key size in bits.
    3. Generate the certificate in one of the following ways.
      • Generate CSR: Click this button to generate a CSR and submit it to your CA. Send the generated .csr file to your CA and get it signed, following the guidelines on your CA's website. Once you receive the signed certificate files, apply them using the steps in the section above.
      • Generate & Apply Self-Signed Certificate: Click this button to generate a self-signed certificate. The certificate is applied automatically. Restart SecureAI for the change to take effect.

    To clear the fields and start again, click Reset.