Security Compliance

SEM - How to setup CA Signed Certificates

This article shows how to create a new CA signed certificate and how to enable TLS using the same certificate, either self-signed or CA signed. Security Event Manager uses certificates to create a secure connection over port 8443. TLS is used to secure connections when viewing reports. By default, SEM uses a pre-made self-signed certificate.

First published date

10/10/2018 2:13 PM

Last published date

9/10/2026 4:16 PM

Overview

This article explains how to export a cert request, get it signed, and then import the signed cert into your Security Event Manager.

Product section

Security Event Manager

Cause

N/A

Resolution

By default SEM uses a default self-signed certificate singed by the SEM appliance itself.
 
This article shows you how to create a new CA (internal /External) signed certificate and import to SEM appliance and how to enable TLS using the CA signed certificate.

Part 1: Signing a certificate by your Certificate Authority 

Generate Public and Private key and export the Certificate Signing Request file (CSR). 

  1. Open a Console Session to the SEM via ( Hyper-v/Vmware > Guest VM console) or SSH to the SEM on port 22.
  2. Type manager then press enter to get into manager menu
  3. Type exportcertrequest  and press Enter.
  4. When prompted, press Enter to continue. 
  5. Specify a network location to export the certificate request file to, and then press Enter.
  6. Confirm that the share location is accurate, and then press Enter.
  7. Enter the network credentials in the following format: domain\user. If the share is authenticated from local credentials and not domain, you can just enter the user name.
  8. You will be prompted with default parameters. If you selected no, fill in the required info:
    1.  Enter the Key Length (Either 2048 or 4096).
    2.  Specify the RSA algorithm as SHA512.
    3.  Change the DN as needed by your organization.

Once all required info is entered, SEM will create the Public and Private key internally and save it locally.on the server.
It will save the certificate request request file to the network path you provided in step 5 above, the file will be named like ex: TNS-HOSTNAME-CertRequest.csr.

Part 2: Requesting a certificate from the Certificate Authority (Microsoft) 

Using the web certificate management 

  1. From the Certificate Authority server, navigate to the certificate website http://localhost/certsvr
  2. Click Request a certificate.



  3. Select Advanced Certificate Request.
  4. Click Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file. 



  5. Open the exported Certificate request in a text editor and paste it into Base-64-encoded certificate request (CMC or PKCS #10 or PKCS #7).
  6. Select the appropriate Certificate Template. (This is specific to the templates on your CA and may not be a User template.)
  7. Click Submit.
  8. !Important! In the Certificate Issued window, select the Base 64 Encoded radio button, and then click Download Certificate Chain. (Must be Chain!)

    image.png

  9. Locate the downloaded certificate, and then open it (double-click or right-click & select open).
  10. Right-click on each certificate in the chain, and then export them in Base-64 encoded format. 



  11. You must combine all files you just exported into a single file, by opening a text editor and save the files into a single file named signed.pem.  The order needs to be Root CA > Subordinate CA 1 > Subordinate CA 2 >  SEM signed certificate. If your CA does not use Intermediate / Subordinate CA's then ignore that part and only copy Root CA and Cert and save the file as signed.pem


You now have a fully chained PEM file.

Part 3: Import the Certificate Authority signed PEM file 

  1. Go back to  SEM CLI session opened in part 1 or Open a Console Session to the SEM it is is closed.
  2. Type manager then press enter to get into manager menu
  3. Type importcert  and press Enter.
  4. Specify the network path where the chained pem file you created resides (signed.pem), and then press Enter.
  5. Enter the network credentials in the following format domain\user. If the share is authenticated from local credentials and not domain, you can just enter the user name.
  6. Enter your password and confirm it.
  7. Enter the name of the pem file (signed.pem).

SEM will import the certificate chain and should now be using it for communication on port 8443. To import the certificate for use in the Reports Console for TLS communication follow Use TLS communication in the Reports Console.guide.

Note: As of SEM 2022.4, wild card SSL certificates are not supported. However, it is planned for a future release.