The method that you choose to create the X.509 certificate depends on your organization's security requirements.

You create one certificate only for the entire site.

The following sections provide information on creating self-signed X.509 certificates and on creating certificates using your organization's certificate infrastructure .

• Run the tlstool.exe command on an Tealeaf server as follows:

  "install_directory\Tools\TLSTool.exe" create -site path password

  where path is the path name where you want the certificate file to be created, and password is the password used to encrypt the private key.

  Note: The password must consist entirely of ASCII characters.
  For example:

  "install_directory\Tools\TLSTool.exe" create -site "C:\test\TCXcert.pfx" password

• To use an X.509 certificate created with your organization's certificate infrastructure, the following conditions must exist:
  • The certificate must have a subject name of Tealeaf CX and be suitable for use by both TLS 1.2 clients and servers.
  • The certificate must be stored in a single file in PKCS#12 format containing both the certificate and its associated private key.
  • The private key must be protected by a password consisting entirely of ASCII characters.

Use the following procedure to import the X.509 site certificate onto the PCA server.

1. Transfer the certificate file to the PCA installation path <install_directory>/etc.

   The default PCA installation directory is /usr/local/ctccap.

2. Extract the .crt and .key file from the .p12 or .pfx file.

   To extract the key: <install_directory>/bin/openssl pkcs12 -in TCXcert.pfx -nocerts -out TCXkey.pem.

   To extract the cert: <install_directory>/bin/openssl pkcs12 -in TCXcert.pfx -clcerts -nokeys -out TCXcert.pem.

After you have imported the X.509 site certificate onto the PCA server(s), you can enable secure communication.

Perform the following procedure to enable secure communication between services running on the PCA server.

1. In the PCA Web Console, under the Delivery tab and under Target Recipients, click Add.
2. Configure the delivery peer with the Secure option checked.
3. Click OK and Save Changes.
4. In the ctc-conf.xml, under <install_directory>/etc/ctc-conf.xml, edit the following Global fields:
   Note: If the following fields are not present in the ctc-conf.xml, refer to the default file ctc-conf-defaults.xml located in <install_directory>/etc/ctc-conf-defaults.xml and add the fields under "Delivery" section. This default file is always updated to the latest version on installs and upgrades. Please merge the applicable fields from the ctc-conf-defaults.xml file to your local ctc-conf.xml file.

   
   <ServerCertPath></ServerCertPath>
   <ClientP12Path></ClientP12Path>
   <ClientP12Pass></ClientP12Pass>
   <ServerCertEnable>false</ServerCertEnable>
   <ClientCertEnable>false</ClientCertEnable>

   Table 1. Settings for ctc-conf.xml

   Field	Set value to. . .
   ServerCertEnable	true
   ClientCertEnable	true
   ServerCertPath	The full path (including filename) to the extracted certificate .pem.
   ClientP12Path	The full path (including filename) of TCXcert.pfx imported/copied from the Windows server.
   ClientP12Pass	The Password used to create the P12 or PFX file (TCXcert.pfx).

   Note: Enabling the secure option in the Web Console without enabling the fields in the ctc-conf.xml file does not work for if Client Authentication is enabled.

   Client Authentication can now be enabled or disabled from the Web Console. The fields for uploading a certificate and its password are displayed on the Web Console only when Client Authentication is enabled and the user accesses the Web Console through HTTPS.

   The uploaded certificate is stored in the <install_directory>/etc directory. Uploading a new certificate with same name overwrites the old certificate.

   Uploading new certificate with different name will not overwrite older certificate, but delivery only uses the new certificate path in the configuration.

5. Restart PCA services by performing a "restart all" or "stop all" followed by "start all".
6. Configure the target HBR or transport service for secure communications as well.

Although this procedure is optional, it is strongly recommended, as all other components will be using Client Authentication.

1. Using any editor, update the runtime.conf to enable the web_console_security_crt_enable as follows:
   /usr/local/ctccap/etc/runtime.conf

   Then enable it, as follows:

   web_console_security_crt_enable=YES

2. Create a username and password for PCA Web Console authentication.

   A client browser that doesn't present the certificate needs to authenticate if web_console_security_crt_enable is enabled.

3. Run the following script and follow the steps to copy your certificates and to generate the p12:

   /usr/local/ctccap/etc/web-crt-gen.sh

4. In an upgrade scenario, compare your current http.conf with httpd.conf.default and copy the new additions to your httpd.conf.
5. For a fresh install "start" and for an upgrade "restart httpd".

To disable secure communication on the PCA server, perform the following steps.

1. Set the following fields in the ctc-conf.xml from true to false.

   <ServerCertEnable>false</ServerCertEnable>
   <ClientCertEnable>false</ClientCertEnable>

2. Remove the "secure" option from the delivery peer in the PCA Web Console.
3. Restart PCA services by doing "restart all" or "stop all" followed by "start all".

To disable secure communication on a PCA server Web Console, perform the following steps.

1. Using an editor of your choosing, update the runtime.conf to disable the web_console_security_crt_enable as follows:

   /usr/local/ctccap/etc/runtime.conf

   and comment it out as follows:

    #web_console_security_crt_enable=YES

2. Run the "restart httpd" command.