IBM Security Guardium

 View Only

  • 1.  How to Install GUI Certificate for multiple Appliances

    Posted 14 days ago

    Hello Experts, Hope all is well at your side.

    I need an guidance on "Guardium GUI Certificate". actually, we have around 10 Appliances on which we required GUI Certificate to be signed by CA. However, I have created CSR request only on 1 appliance & added other appliances hostnames under "SAN". Now, my question is, will I be able to insert single CA signed certificate to other appliances as well ? since, they do not have CSR request generated under them ...? Is there any way around OR Do I need to generate CSR request for each appliance & get it signed by CA and then insert it to individual appliance.  

    Can anyone please assist me in this scenario. With Many Thanks!



    ------------------------------
    Akash Parmar
    +91-9601716334 - IND
    +973-39066960 - BAH
    ------------------------------


  • 2.  RE: How to Install GUI Certificate for multiple Appliances

    Posted 14 days ago
    Hi Akash,

    Please review this link:
    https://www.ibm.com/support/pages/node/7148983
    Is it possible to use a single certificate for all appliances in my environment?


    So you need to create a different csr for each appliance otherwise the only other option is wildcard, but you need to match the requirements.

    Many thanks




    Original Message


  • 3.  RE: How to Install GUI Certificate for multiple Appliances

    Posted 13 days ago

    Dear Mark, Thank you for sharing the info.

    However, I have few doubts here, for example, I have created CSR on single appliance with wild cards , However, while Importing CA Signed certificate to other appliance, it saying that "

    COL1> store certificate gui console
     
    ERROR: Unable to locate a Certificate Signing Request (CSR).
     
    Are you importing a GUI certificate that was generated externally? [y/N]"

    ==================================================================================================

    However, upon selecting below option it is asking to Insert "PRIVATE KEY" - But, I am not sure about which Private key I should Insert here ...?

    COL2> store certificate gui consolez
    Are you importing a GUI certificate that was generated externally? [y/N]
    y
     
    Warning:
    The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /opt/IBM/Guardium/tomcat/.keystore -destkeystore /opt/IBM/Guardium/tomcat/.keystore -deststoretype pkcs12".
     
    WARNING: Alias "tomcat" already exists. Are you sure that you want to replace it? [y/N]
    y
     
    Continuing with GUI certificate replacement...
     
    Please paste your private key below in PEM encoded format. A private key in PEM
    encoded format should include the '-----BEGIN PRIVATE KEY-----' and '-----END
    PRIVATE KEY-----' tags, as follows:
     
            -----BEGIN PRIVATE KEY-----
            (Private Key)
            -----END PRIVATE KEY-----
     
    Once done pasting your private key, press ENTER followed by CTRL-D to continue.

    Could you please help me with this dilemma. I really appreciate your support in this regard. 



    ------------------------------
    Akash Parmar
    ------------------------------

    Original Message


  • 4.  RE: How to Install GUI Certificate for multiple Appliances

    Posted 13 days ago

    Hi Akash,

    I highly recommend you create a new CSR for each appliance using the appliance name to avoid browser warnings when you access the appliance.

    However, in order to use one certificate on multiple appliance using the option of external certificate, you will need another Linux server where you have SSH access to and appliance also have SSH access to that servers. 

    In that Linux server, you will generate a new CSR and private key file using openssl commands. Get the certificate signed, then import it to your appliance through the external option in the "Store certificate gui external" command.

    This is in short what you need to do. I hope this will help.



    ------------------------------
    Mohammed Alzahrani
    ------------------------------

    Original Message


  • 5.  RE: How to Install GUI Certificate for multiple Appliances

    IBM Champion
    Posted 12 days ago

    Hi Akash,

    While you can use 1 certificate for multiple Guardium appliances, there's a special way to do that which is not how you've started.  The method you've started with would require a unique certificate for each box, as the private side of each is stored uniquely on each box, when the CSR is created, and is not something you can extract and share. 

    If you must do one certificate for all, you'll need to generate the certificate outside of Guardium, with the wildcard CN (*.yourdomain.com), save the private and public keys separately, and load in the following order: the CA's public cert (and any in chain to what signed your cert), and then the public and private keys for the cert for the Guardium appliances as generated elsewhere. 

    This process will be: 

    • store certificate keystore trusted [console | external]
      • save the CA trusted cert, and any others in chain that signed what you're going to use as a cert
    • store certificate privatekey gui [console | external]
      • save the private key that you've generated outside of Guardium for what will be your gui-cert, including a CN of *.your.domain.com 
    • store certificate gui console
      • save the signed public key to the pair you've generated outside of Guardium with the CN of *.your.domain.com
    • restart gui

    Note:

    Certificates and private keys must be in PEM format.

    Certificates start with "-----BEGIN CERTIFICATE-----" and end with "-----END CERTIFICATE-----"

    Private keys start with "-----BEGIN RSA PRIVATE KEY-----" and end with "-----END RSA PRIVATE KEY-----"

    Honestly, it's more straightforward to create a csr on each system, and sign it by your CA, but if you really need to do one wildcard cert for all, it's possible.



    ------------------------------
    Elizabeth Davis
    ------------------------------

    Original Message


  • 6.  RE: How to Install GUI Certificate for multiple Appliances

    Posted 6 days ago

    Hello Elizabeth, Good Day!

    Thank you for the detailed info & procedure on this. Appreciate it.  I shall try this now.



    ------------------------------
    Akash Parmar
    ------------------------------

    Original Message