Configuring SSL Certificates for Secure Communication

1. How to issue a trusted SSL certificate for the On-Premise Platform using AD CS with Web Enrollment

Please Note:

1. The certificate of Certification Authority (CA) has to be installed on the clients machines in your domain to integrate the On-Premise Platform with such solutions as OWA.
2. The Common Name (CN) for which the certificate was issued has to be accessible in your domain to integrate the On-Premise Platform with such solutions as OWA.

Prerequisites:

1. AD CS installed with Web Enrollment feature.
2. You need to have access to the Web Server template in certsrv.
3. Keytool and OpenSSL tools are required.

1.1. Generate a Certificate Signing Request (CSR) Using OpenSSL

1. Generate a private key:
   
   

   openssl genrsa -out test-server.key 2048

2. Create a CSR:
   
   

   openssl req -new -key test-server.key -out test-server.csr

1.2. Submit the CSR to AD CS to issue and download a certificate

1. Open the AD CS web interface:
   
   

   http://CA-Server-Name/certsrv

2. Select Request a Certificate:
   
   


3. Select Advanced Certificate Request:
   
   
   
4. Open your .csr file in a text editor, copy its contents, and paste it into the request box.
5. Choose the Web Server template and submit the request:
   
   
   
6. The Certificate Issued page should be opened, Select Base64 encoded checkbox.
7. Click on the Download certificate.
8. (Optional) Click on the Download certificate chain in case you need your CA to be trusted in your domain. Import the ca-chain.pem into the Trusted Root Certification Authorities store on the clients machines.

1.3. Import a SSL certificate to the Protectimus Platform

2. How to Import Trusted SSL Certificate

1. Combine the certificate (test-server.cer) and the private key (test-server.key) into a PKCS12 file which is Java-compatible keystore (.jks) format:

openssl pkcs12 -export -in test-server.cer -inkey test-server.key -out test-server.pfx

2. Create a Java Keystore and import the .pfx file into it:

keytool -importkeystore -srckeystore test-server.pfx -srcstoretype PKCS12 -destkeystore “C:\Program Files\Protectimus\Platform\keystore.jks” -deststoretype JKS

3. How to Configure SSL Certificate, Mail and SMS Tokens, and Specify the Path to the License File

• Add SSL certificate for the Protectimus Platform. Different SSL certificate formats are supported, including .pkcs12, .pem, .der, .pfx.
• Configure delivery of messages via email;
• Configure SMPP server connection to add your SMS provider to deliver one-time passwords via SMS.
• Specify the path to the license file. Please note that the path to the license file should be indicated with double backslashes
  (eg. C:\\some\\path\\file).

3.1. SSL Certificate Configuration

https.port

https.keystore.type

https.keystore.password

https.keystore

https.port = 8443
https.keystore.type = JKS
https.keystore.password = **********
https.keystore = C:\\Program Files\\Protectimus\\Platform\\keystore.jks

3.2. Email Message Delivery Configuration

smtp.host

smtp.port

smtp.user

smtp.password

default.from.address

smtp.host = smtp-server.com
smtp.port = 25
smtp.user = user@example.com
smtp.password = **********

3.3. SMPP Server Connection Configuration

PLEASE NOTE! Additionally, you can configure settings for SMSC and ALIBABA as well.

smpp.server.login

smpp.server.password

smpp.server.host

smpp.server.port

smpp.message.encoding

smpp.from.address

smpp.server.login = login
smpp.server.password = **********
smpp.server.host = smpp.example.com
smpp.server.port = 12000
smpp.message.encoding = UTF-8
smpp.from.address = Protectimus