Security Compliance

How to sign an SSL certificate in a Windows command prompt with SEM

This article describes how you can sign an SSL Certificate in Windows cmd.

First published date

10/9/2018 5:42 PM

Last published date

10/9/2018 5:42 PM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager).

This article describes how you can sign an SSL certificate in a Windows command prompt.

Product section

Security Event Manager

Resolution

  1. SSH into the manger with cmc user and by using the IP address and port number 32022.
  2. In the prompt, enter manager. 
  3. In the prompt, enter exportcertrequest.
  4. Use PKI tools to sign the certificate sign request (CSR) file.
    1. Get the signed certificate into the PEM format for Java, and save in Base64 bit, chained cert, *.cer format.
    2. Include all of the certificate chain up to the root self-signed CA certificate.
      1. First, the signing certificate in PEM format (CA public certificate).
      2. Then, the signed request in PEM format (new SEM certificate, signed by your CA).
    3. To do this on a Windows subordinate CA:
      1. Open a cmd prompt and execute the following command: 
        certreq -submit -attrib "CertificateTemplate:HTTPS" <Request Filename>
      2. In this folder, find the certificate you just issued, double-click to open it, then click the Details.
      3. On the Details tab, click Copy to File…. Choose PKCS #7 format and check the Include all certificates in the certification path if possible checkbox.
      4. Find the resulting .p7b file and double-click to view it. Expand the folders in the left-hand pane down to Certificates.
      5. Right-click and choose Export…, one at a time, each certificate you see listed in the right-hand side. Choose Base-64 encoded X.509 (.CER) format.
    4. Once you have exported all the certificates in the chain you need to concatenate them together, in order from SEM to root CA. Open them all in notepad. Copy the subordinate CA certificate and paste it at the end of the SEM certificate. Copy the root CA certificate and paste it at the end of the SEM+subordinate certificate. Save this file to a network share that your SEM can access.
  5. In the ssh terminal as cmc, enter  
    importcert
  6. Provide windows share and credentials to import the combined PEM file. New certificates should be imported into keystore and manager restarted.
  7. Once the manager is completely started, open browser tab to manager and view the certificate for verification.
  8. Import the certificate into your Trusted Root Authority by going to the MMC console.