[APPM]Generate a CSR (Certificate Signing Request)

Generate a Certificate Signing Request (CSR)

1. Request information from customer:

For the private key (Step 2):

Common Name (CN): (e.g. appm.secureki.com)

Country (C): (e.g. MY)

State or Locality (S/L):

Organization Name (O):

Organization Unit (OU):

For the CSR (Step 3):

DNS Name: (e.g. appm.secureki.com)

IP Address: (VIP and real IP of every APPM server)

2. Generate Private Key

$ keytool -genkeypair -alias secureki -keyalg RSA -keysize 2048 -keystore key_client.ks -dname "CN=appm.secureki.com, OU=<OU>, O=<O>, L=<L>, ST=<ST>, C=MY"

Replace the values with the customer's information from Step 1.

Delete any field the customer does not use (for example L, ST or C).

It will ask for passwords:

1. Enter keystore password: type a password

2. Re-enter new password: type it again

3. Enter key password for <secureki>: type the SAME password

4. Re-enter new password: type it again

IMPORTANT: Write down the password. You need it in Step 3 and when importing the certificate.

3. Generate CSR

$ keytool -certreq -keyalg RSA -alias secureki -file cert_server.csr -keystore key_client.ks -sigalg SHA256withRSA -ext SAN=dns:appm.secureki.com,ip:192.168.1.100,ip:10.0.0.5

It will ask for the keystore password. Type the password from Step 2.

How to write the SAN part (-ext SAN=...):

- For every DNS name, write dns:name

- For every IP, write ip:address

- Separate each one with a comma, with no spaces

- The CN from Step 2 must also be in this list

4. TWO files will be generated:

- cert_server.csr

- key_client.ks

Note: you can use any file name. For example, use ent.csr and ent.ks for the Enterprise environment.

The keystore name in Step 2, Step 3 and the import step must be the same.

5. Send the cert_server.csr to customer to generate the SSL certificate

Send ONLY the .csr file. Do NOT send the .ks file.

6. ENSURE to keep the key_client.ks file. This file will be needed to import the SSL certificate into keystore.

It contains the private key. If you lose it, you must create a new CSR.

Notes:

To import the certificate into keystore, refer [APPM]Import SSL Certificate into Keystore

To verify CSR contains the correct information, https://www.sslshopper.com/csr-decoder.html