Step 0: change password



Step 1: Create the CSR and Private Key, and send to your Certificate Authority:

1. Go to /webserver//bin command prompt

2. pskeymanager - create

a. Most of the prompts are self-explanatory, but please note the following:

i. For ‘common name’, but sure to specify the host name as it appears in the url that users will be using to sign into PIA

ii. Use default value for ‘key size’, ‘key algorithm’, and ‘signing algorithm’

iii. Don’t forget what value you enter for private key password as it is unrecoverable

3. The above command creates a private key (in the keystore) and a certificate request

4. Make a backup of the keystore:

a. Go to directory /webserv//keystore

b. copy pskey pskey-bak

5. Send certificate request (created in step 2) to your Certificate Authority (CA)

6. Note that you can now view the private key you created via command:

pskeymanager -list -v -keystorepassword password >list.txt

(will see your new "private key" entry in list.txt, with entry type 'keyEntry')

Step 2: Certificate Authority sends 3 files:

In the email that your CA will send to you, there should be 2 links to their website, one to download the root CA and another one for the intermediate CA if there's any. You will have to go to their website and download them. Another way to obtain them is to double click on the certificate file and then go to the Certification Path tab. The first cert in the list is the root CA and the second one is the intermediate CA if there's any. If you highlight the root CA and then click on "View Certificate", it will open up the Root CA certificate. Then you can go to the Details tab and click on "Copy to file". Select Based 64 as the format and save the file. Repeat the same steps to copy the intermediate CA to a file.

Once you have the 3 files (root CA, intermediate and certificate), concatenate them together using WordPad. If you have an intermediate CA, edit it and do a "Select All", and then "Copy". Then edit your certificate file and paste the intermediate at the bottom of the server certificate. If you don't have an intermediate CA, you can skip this step. Then do the same with the root CA and paste it at the very bottom You will end up with a certificate that looks like this:

-------BEGIN CERTIFICATE---------

dfsfsdfdf

sfsdfwehdfhdf ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download