Generating custom certificates

You can use the enecerts utility to generate customized certificates.

You can generate two types of customized certificates by:

Specifying a private key size larger or smaller than the default 1024-bit size.
Using your own CA file and private key to generate the eneCert.pem certificate.

The next two sections describe these operations.

Specifying a different certificate key size

The --keysize flag of the enecerts utility lets users specify the size of the generated private key. The flag syntax is:

--keysize bits

where bits is the private key size in bits (default value is 1024).

For example, the following Windows command creates certificates with a private key size of 2048 bits:

enecerts --keysize 2048

Keep in mind that using larger keys will slow system performance. A recommended alternative to the default 1024-bit size is a key size of 512 bits, which will give you a good balance between security and performance considerations.

Using your CA file to generate certificates

By default, the enecerts utility produces the eneCert.pem certificate (used by all clients and servers to specify their identity when using SSL) and the eneCA.pem CA certificate (used by all clients and servers that wish to authenticate the other endpoint of a communication channel).

If you have your own CA certificate and private-key files, you can use the --CAkey and --CAcert flags to generate the eneCert.pem certificate. The private-key file (.key extension) is used to digitally sign the public key that is generated by the enecerts utility. Both flags must be used for this operation.

The syntax for the --CAkey flag is:

--CAkey private-key

where private-key is your own .key file with the private key for the CA that should be used to sign the generated certificate.

The syntax for the --CAcert flag is:

--CAcert cert-pem

where cert-pem is your CA certificate (.pem extension). This file is the same type of file as the default eneCA.pem CA certificate.

For example, the following Windows command creates a signed certificate file using your own CA certificate and private-key files:

enecerts --CAkey myCA.key --CAcert myCA.pem

You would then use the resulting eneCert.pem certificate and your CA file (myCA.pem in the example) to configure SSL for your Endeca components. If you have multiple machines in your deployment, you must also copy these files to the other machines.