Sun ONE logo     Previous     Contents     Index     Next     
Sun ONE Portal Server, Secure Remote Access 6.0 Installation Guide



Chapter 4   Installing SSL Certificates


This chapter provides details on installing SSL certificates after installing the Secure Remote Access.

This chapter includes the following sections:



Overview of SSL Certificates

An SSL certificate provides encryption and decryption capabilities using a public and private key pair. A self-signed certificate is generated and installed when you install the gateway, if you choose to install the certificate during installation. You can replace the installed certificate with another one that you generate or obtain anytime after installation. If you chose not to install the certificate during installation, you can generate and install a self-signed certificate, or a certificate that has been purchased from some certificate authority (CA), at a later point in time.

Secure Remote Access provides a tool called certadmin that you can use to manage the SSL certificates.

See the chapter, Working With Certificates in the Sun ONE Portal Server, Secure Remote Access 6.0 Administration Guide for more information.


Note You need to generate and install an SSL certificate for each gateway installation.




Generating Self-signed Certificates


You need to generate certificates for each server and gateway component between which you want SSL communication.


To Generate a Self-signed Certificate After Installation


Note certadmin does not support multibyte entries. When you invoke any of the options of the certadmin tool, and supply a multibyte entry as a value for the questions asked, certadmin will not accept the value.

If you generate a certificate signing request (CSR) with multibyte entries using some other utility, certadmin will sign the request and handle the certificate.


  1. As root, run the certadmin script on the gateway machine for which you want to generate a certificate

    InstallDir/SUNWps/bin/certadmin -n profilename

    The Certificate Administration menu is displayed.

    1) Generate Self-Signed Certificate
    2) Generate Certificate Signing Request (CSR)
    3) Add Root CA Certificate
    4) Install Certificate From Certificate Authority (CA)
    5) Modify Trust Attributes of Certificate (e.g., for PDC)
    6) List Root CA Certificates
    7) List All Certificates
    8) Quit
    -------------------------------------
    choice: [8] 1

  2. Type 1 to generate a self-signed certificate.

    The Certificate Administration script asks you if you want to keep the existing database files.

    Do you want to keep the existing certificate database files? [y]/n

  3. If you answer as y, the script prompts you to enter certain organization-specific information, token name and the certificate name.
    Note For a wild card certificate, you need to specify a * in the fully-qualified DNS name of the host. For example, if the fully-qualified DNS name of the host is abc.sesta.com, specify it as *.sesta.com. The certificate that is generated is now valid for all host names in the sesta.com domain.


    What is the fully-qualified DNS name of this host? [host_name.domain_name]
    What is the name of your organization (ex: Company)? []
    What is the name of your organizational unit (ex: division)? []
    What is the name of your City or Locality? []
    What is the name (no abbreviation please) of your State or Province? []
    What is the two-letter country code for this unit? []
    Token name is needed only if you are not using the default internal (software) cryptographic module, for example, if you want to use a crypto card (Token names could be listed using: modutil -dbdir /etc/opt/SUNWps/cert -list); Otherwise, just hit Return below.
    Please enter the token name []
    Enter the name you like for this certificate:

    The token name (default being empty) and certificate name are stored in the .nickname file under /etc/opt/SUNWps/cert.

  4. If you answer as n to the question "Do you want to keep the existing certificate database files?", the original certificate directory is backed up, and the script asks you for organization-specific information, token name and certificate name as explained earlier.

    You are also asked for a passphrase. A passphrase is required because a new set of certificate, key and encryption module database files will be created. The passphrase is stored in the .jsspass file under /etc/opt/SUNWps/cert.

    Enter passphrase []:

    A self-signed certificate is generated and the prompt returns.

  5. Restart the gateway for the certificate to take effect.

    To restart the gateway, type the following command:

    InstallDir/SUNWps/bin/gateway -n new profile name start



Installing Certificates From a Certificate Authority

Installing certificates from a Certificate Authority (CA) involves the following procedures:

  1. To Generate a Certificate Signing Request (CSR)

  2. To Order a Certificate From a CA

  3. To Install a Certificate From the CA


To Generate a Certificate Signing Request (CSR)

Before you can order a certificate from a CA, you need to generate a certificate signing request which will contain the information that is required by the CA.

  1. As root, run the certadmin script.

    InstallDir/SUNWps/bin/certadmin -n profilename

    The Certificate Administration menu is displayed.

    1) Generate Self-Signed Certificate
    2) Generate Certificate Signing Request (CSR)
    3) Add Root CA Certificate
    4) Install Certificate From Certificate Authority (CA)
    5) Modify Trust Attributes of Certificate (e.g., for PDC)
    6) List Root CA Certificates
    7) List All Certificates
    8) Quit

    choice: [8] 2

  2. Type 2 on the menu to generate a certificate signing request (CSR).

    The script prompts you for organization-specific information, web master's email and phone number, and token name.

    Ensure that you specify the fully-qualified DNS name of the host.

    What is the fully-qualified DNS name of this host? [snape.sesta.com]
    What is the name of your organization (ex: Company)? []
    What is the name of your organizational unit (ex: division)? []
    What is the name of your City or Locality? []
    What is the name (no abbreviation please) of your State or Province? []
    What is the two-letter country code for this unit? []

    What is the email address of the admin/webmaster for this server [] ?
    What is the phone number of the admin/webmaster for this server [] ?

    Token name is needed only if you are not using the default internal (software) cryptographic module, for example, if you want to use a crypto card (Token names could be listed using: modutil -dbdir /etc/opt/SUNWps/cert -list); Otherwise, just hit Return below.

    Please enter the token name []

  3. Type all the required information.


    Note Do not leave the web master's email and phone number blank. The information is necessary for getting a valid CSR.


A CSR is generated and stored in the file /tmp/csr.hostname. The CSR is also printed on the screen. You can directly copy and paste the CSR when you order a certificate from a CA.


To Order a Certificate From a CA

After generating a certificate signing request (CSR), you need to order for the certificate from the CA using the CSR.

  1. Go to the Certificate Authority's web site and order your certificate.

  2. Provide the CSR obtained from Generating a Certificate Signing Request (CSR), as requested by the CA. Provide other information, if requested by the CA.

    You will receive your certificate from the CA. Save it in a file. Include the "BEGIN CERTIFICATE" and "END CERTIFICATE" lines with the certificate in the file.

    The following example omits the actual certificate data.

    -----BEGIN CERTIFICATE-----
    The certificate contents...
    ----END CERTIFICATE-----


To Install a Certificate From the CA

Using the certadmin script, install the certificate obtained from the CA in your local database files in /etc/opt/SUNWps/cert.

  1. As root, run the certadmin script.

    InstallDir/SUNWps/bin/certadmin -n profilename

    The Certificate Administration menu is displayed.

    1) Generate Self-Signed Certificate
    2) Generate Certificate Signing Request (CSR)
    3) Add Root CA Certificate
    4) Install Certificate From Certificate Authority (CA)
    5) Modify Trust Attributes of Certificate (e.g., for PDC)
    6) List Root CA Certificates
    7) List All Certificates
    8) Quit
    choice: [8] 4

  2. Type 4 on the menu to install your certificate from the CA.

    The script asks you to enter the certificate file name, certificate name, and the token name.

    What is the name (including path) of file that contains the certificate?
    Please enter the token name you used when creating CSR for this certificate []

  3. Supply all the required information.

    The certificate is installed in /etc/opt/SUNWps/cert, and the screen prompt returns.

  4. Restart the gateway for the certificate to take effect. Use the following command:

    InstallDir/SUNWps/bin/gateway -n profile name start



Installing a Root CA Certificate

If a client site presents a certificate signed by a CA that is unknown to the gateway certificate database, the SSL handshake will fail.

To prevent this, you need to import a root CA certificate into the certificate database. This ensures that the CA becomes known to the gateway.

Browse to the CA's website and obtain the root certificate for that CA. You need to specify the filename and path of the root CA certificate when you run the certadmin utility.


To Import a Root CA Certificate

  1. As root, run the certadmin script.

    InstallDir/SUNWps/bin/certadmin -n profilename

    The Certificate Administration menu is displayed.

    1) Generate Self-Signed Certificate
    2) Generate Certificate Signing Request (CSR)
    3) Add Root CA Certificate
    4) Install Certificate From Certificate Authority (CA)
    5) Modify Trust Attributes of Certificate (e.g., for PDC)
    6) List Root CA Certificates
    7) List All Certificates
    8) Quit
    choice: [8] 3

  2. Choose option 3 on the certificate administration menu.

  3. Enter the name of the file that contains the root certificate, and enter the name for the certificate.

    The root CA certificate is added to the certificate database.


    Note Certificate details can be viewed using the gwcertutil tool. This is a wrapper over the certutil tool provided by NSS/JSS.



Previous     Contents     Index     Next     
Copyright 2002 Sun Microsystems, Inc. All rights reserved.

Last Updated September 23, 2002