Objective

Today SSL certificates are managed in several different places which makes updating existing certificates and issuing new certificates difficult and prone to errors. We currently have three separate certificate processes. Java based backend services use a password protected local key store to house certificates. The key store is maintained as part of the development code line and is distributed as part of the software’s package. Java services include:

...

Queue Adapter is an outlier in that it follows the same process as the core web applications when deployed in AWS but has its own process when deployed on premise. When deployed on premise, Queue Adapter requires the installer to download an unsecured copy of the certificate and apply it to the Windows certificate manager. The installer must then assign the certificate to a specific port using Windows command line. Anyone with administrative access to the server can export the certificate and use it however they want.

Success metrics

Assumptions

Requirements

User interaction and design

Open Questions

Out of Scope

SSL Run-Book

Convert DER to PEM Format

...

1. keytool -keypasswd -alias [Alias name for private key] -keystore

Overview and Requirements

The purpose of this document is to give direction on how to update wildcard certs in use for the OM QA in an https deployment environment.

Required Items:

·       Administrative access and rights to hosted environment

·       New Cert and Password for cert

Reference material:

https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-configure-a-port-with-an-ssl-certificate

 Take the new wildcard cert and put it on the box.  Some Environments require Personal, others do not.  If you are unsure what folder to import the cert to, check to see where the current cert is installed.  You can do that by finding out the APPID (see page 5 for instructions) of the cert and then looking for the cert in Console.

Ex.

...

Add the Certificates Snap-in in MMC.exe.

...

 Import the Certificate to Folder you want (Personal, Trusted, Root Trusted etc).

Right click the cert you have placed on the box and chose Install PFX.  This will open the Certificate Import Wizard.

...

Note:  Make sure, when importing the cert, that the two below items are checked.

...

 Once the Cert is installed, navigate to the Folder you put it in.

Double click the cert and go to “Details”.  Scroll down to the “Thumbprints” section.  Copy out the QUID that is inside the thumbprint because it will be needed later.  It may not allow you to copy paste it out.

...

Find the Application ID of the current Certificate

Open a CMD line in administrator mode.

Ex.  netsh http show sslcert

Copy out the Application ID into a notepad, you will need it later.  Include the curly brackets.

...

 Now, you have the Application ID of the current cert and the QUID of the new cert.  We need to add the new QUID to the Application that has the old cert.

Note:  Make sure QA is off while performing this next step.

Go back to your Administrator CMD line.

Delete the cert that is already bound to the port you need to use, QA uses port 5001.

Ex.  netsh http delete sslcert ipport=0.0.0.0:5001

...

Now, we are going to re-attach the new cert to the old Application ID with the new Cert thumbprint.

Note:  “certhash” is the thumbprint you grabbed from the cert but with no spaces in it.  Make sure that when you copy in the certhash that there are no special characters from the import.  There is almost always a hidden space at the end of the number.  You can use Word or Notepad++ to see these errors.

Ex.  netsh http add sslcert ipport=0.0.0.0:5001 certhash=**** appid={***}

...

Restart QA service.