pdf icon
Category Filter

Securing Communication using 3rd Party Certificates

Securing corporate data is a top priority in every organization and encryption using third-party certificates is the most secure option. These third-party certificates ensure that the corporate data can only be decrypted if they have the certificate available. Mobile Device Manager Plus allows organizations to secure the communication with the managed devices using SSL certificates.

This certificate is valid for a specified term. If the certificate expires, then the devices won't be able to communicate with the MDM server. The admin won't be able to manage any mobile devices, till they renew the certificates and upload it in the MDM server.


These are the pre-requisites for uploading TLS Server certifictes:

  1. TLS server certificates and issuing CAs using RSA keys must use key sizes greater than or equal to 2048 bits.
  2. TLS server certificates must have SHA-2 family hash algorithm.
  3. TLS server certificates must have the DNS name of the server in the Subject Alternative Name extension of the certificate.
  4. TLS server certificates must have "TLS Server Authentication" (id-kp-serverAuth (OID) - extended key usage extension.
  5. The TLS server certificates being uploaded should have a maximum validity period of only 397 days.
  6. TLS server certificates must not be a self-signed certificate.

Follow the steps mentioned below to create and upload third Party Certificates:

  1. Create CSR and Key Files
  2. Submit the CSR to a Certificate Authority (CA) to Obtain a CA Signed Certificate
  3. Upload the third party Certificates to Mobile Device Manager Plus

Create CSR and Key Files

To create CSR and Key files, follow the steps mentioned below:

    1. In <Installation_Directory>\ManageEngine\MDMServer\apache\bin, create a file named opensslsan.conf, and copy the following code into the file:

        distinguished_name = req_distinguished_name
        req_extensions = req_ext
        [ req_distinguished_name ]
        countryName =
        stateOrProvinceName =
        localityName =
        organizationName =
        commonName =
        [ req_ext ]
        subjectAltName =
        DNS.1 =
        DNS.2 =
        DNS.3 =


    1. In the code, enter the two letter Country Code next to countryName. Check the two letter country code of your country here.
    2. Next, enter the full name of your state or province next to stateOrProvinceName.
    3. Next to localityName, enter the name of your locality. Specify the name of your organization, next to organizationName.
    4. Enter the name of your website or domain beside commonName. The FQDN of the web server (the host name), that is going to receive the certificate, is the Common Name. Do not include the following details while entering the Common Name:
      -> protocol (http:// or https://)
      -> port numbers or pathnames
    5. Enter the Subject Alternative Name (SAN) of your website next to DNS.1, DNS.2, etc. in the code one by one. You can have many SAN for a single certificate. You can add more SAN by adding DNS.4, DNS.5, and so on, at the end of the code. Here is an example:

        distinguished_name = req_distinguished_name
        req_extensions = req_ext
        [ req_distinguished_name ]
        countryName = US
        stateOrProvinceName = IL
        localityName = Chicago
        organizationName = Zylker
        commonName = www.zylker.com
        [ req_ext ]
        subjectAltName = @alt_names
        DNS.1 = *.domain.com
        DNS.2 = zylker-it.com
        DNS.3 = zylkerteam.com


  1. Save the file, go to command prompt, and navigate to <Installation_Directory>\ManageEngine\MDMServer\apache\bin directory
  2. Execute openssl.exe req -out server.csr -newkey rsa:2048 -nodes -keyout private.key -config opensslsan.conf command.
  3. Files named server.csr and private.key are created.
  4. To verify the details, use openssl.exe req -in server.csr -noout -text -config ..\conf\openssl.cnf command.

NOTE: Do not delete the file private.key that is generated.

Submit the CSR to a Certificate Authority (CA) to obtain a CA Signed Certificate

  1. Submit created server.csr to CAs. Check their documentation / website for details on submitting CSRs and the cost to be paid to the CA.
  2. This process usually takes a few days time after which you'll be provided a signed SSL certificate and the CA's chain/intermediate certificate as .cer files
  3. Save these files and rename your signed SSL certificate file to server.crt

Upload the third party Certificates to Mobile Device Manager Plus

  1. On the MDM server, click Admin tab
  2. Under Security Settings, click Import SSL Certificates
  3. Browse to upload the certificate that you have received from the CA. The certificate will be available in .crt format for SSL and in .pfxformat for PFX certificates
    • Once you upload a .crt file, you will be prompted to upload the Server Key. In the Server Key field, upload the private.key file generated while creating the CSR.
    • After uploading the Server Key, you will be prompted to upload the intermediate certificate. If you choose Automatic, then the intermediate certificate will be detected automatically. However when the intermediate certificate is detected automatically, only one certificate will be detected. If you wanted to use your own intermediate certificate, or upload more than one intermediate certificate, then you need to select Manual, and manually upload the certificates.
    • If you choose to upload a .pfx file, then you will be prompted to enter the password provided by the vendor.
  4. Click Save to import the certificate.

You have successfully imported the third party certificates to Mobile Device Manager Plus server. These certificates will be used only when "HTTPS" mode is enabled for communication.

NOTE:Click Admin tab and choose Server Settings, to enable Https mode under General Settings.

Jump To