...

Certificate Import and Enabling TLS/SSL on Syndeia Cloud

...

Overview

The following OS-specific section will guide you through re-configuring Syndeia Cloud (SC) to: 

• a.  begin using a certificate of your choosing (ie: commercial 3rd-party, internal CA, or self-generated)
• b.  listen for HTTPS traffic on TCP port 9443 (  not 443, but it can be configured to do so), and
• c.  stop listening for HTTP traffic on TCP port 9000.

 Once complete you will also need to configure your firewall to allow the new port, ex: 9443.  

 Note, this document is not an in-depth discussion on certificate generation + management.  If you are unfamiliar with any of the terminology or need a review, you can refer to the section below but please refer to other primary sources for additional information.      

Terminology

1. X.509:  An ITU-T standard based on the ASN.1 standard
2. Public Key Cryptography Standard (PKCS):  a set of standards published by RSA
3. Public Key Infrastructure (PKI):  Overall infrastructure based on public & private key cryptography (large prime numbers), usually includes services for issuing, signing, renewing, and revoking certificates
4. Certificate Authority (CA):  a central authority (server) used to sign and issue certificates, usually public, ex: Verisign, Thawte, etc.
5. Root CA:  Top-level CA, usually the cert for this is self-signed and the public cert is distributed and installed to all clients, the private keys for this are usually locked away in a secure offline location to prevent compromise
6. Signing/Intermediate CA:  CA that is actually used to sign certificates
7. Certificate Revocation List (CRL):  list of revoked certificates
8. Online Certificate Status Protocol (OCSP):  protocol to detect if a certificate has been revoked
9. .CSR (Certificate Signing Request):  file extension defining a certification request, it is what is presented to the signing-CA for signing to become a certificate, consists of three main parts: the certification request information, a signature algorithm identifier, and a digital signature on the certification request information, usually encoded in PKCS#10- a Base64 (plain-text) format,
10. Certificate:  the public key of a server/client/user with accompanying meta-data signed by a trusted authority, used for authentication, also called an X.509 certificate as it defines the format of certificates.  Usually includes an expiration date.
11. Wildcard certificate:  a certificate that allows any hostname under a specific domain name.  
12. Subject Alternative Name (SAN):  An X.509 v3 extension allowing for alternative Fully Qualified Domain Names (FQDN)s/domains to be defined, ex: DNS:wikiversity.org, DNS:wikivoyage.org, DNS:wiktionary.org
13. Full chain:  used to indicate that all certificates up to a root authority are available, ie: root-CA, signing/intermediate-CA, issued server/client/user certificate
14. .DER (Distinguished Encoding Rules):  is a subset of the X.690 ITU-T standard specifying several ASN.1 encoding formats; also a file extension for certificates (usually binary encoded).  
15. .PEM (Privacy-enhanced Electronic Mail):  certificate extension, Base64 (plain-text) encoded DER certificate, enclosed between "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----"
16. .CER, .CRT (Certificate):  certificate extension, X.509 format usually or Base64 (plain-text).  
17. .P7B, .P7C (PKCS#7):  bundled certificate extension, SignedData structure without data, just certificate(s) or CRL(s)
18. .P12 (PKCS#12) / .PFX (Personal inFormation eXchange):  bundle of (usually full-chain) certificate(s) (public) and private keys (password protected); PFX was a MS IIS standard that was the precursor to P12.  
19. .JKS (Java Key Store):  Java key store (repository) and extension used to store private keys, public keys, and certificates, created by Java’s keytool binary

...

5. On the Syndeia Cloud server, import into Java Key Store (JKS) from PFX (PKCS12), where host.domain.tld = your server's FQDN, ie: syndeia-cloud.company.com, and <path_to_keystore> = your JKS path, normally /etc/java or you can create /opt/icx/syndeia-cloud-<version>/conf/keystore , and place it there (  Note, you will need to create a password for the keystore + specify the password created in the previous step to protect exporting the private key).   Whichever place you put it, make sure the service running Syndeia Cloud, ie: syndeia-cloud, has Read permissions to that file (or ideally owns it w/ Read permission if you decide to put it in /opt/icx/syndeia-cloud-<version>/conf/keystore)  

keytool -importkeystore -srckeystore host.domain.tld_CA-name_ca-chain_priv-key.pfx -srcstoretype pkcs12 -destkeystore <path_to_keystore>/host.domain.tld_CA-name.jks -deststoretype jks

 Note, you will need to create a password for the keystore + specify the password created in the previous step to protect exporting the private key

 Note, you may get a warning about the keystore being in a proprietary format, you can ignore this.  

...