Import SMGR CA Cert to Session Manager

[RedTech443]

Loking for best practice guidance on not using the default cert in Session Manager 8.1

I have a newly deployed SMGR 8.1 and Session Manager 8.1
Currently all connected using default certs.

I am looking to harden it a bit and replace with a System Manager signed cert. I did this while back but seems I cannot find the options to do so anymore.

How do I import the System Manager cert into Session Manager and validate that session manager is only using this cert for further communication?

 

[kyle555]

as of 6.3.8, initTM makes SM use a cert it requests from your SMGR. initTM -d makes it offer the demo cert on the SIP interface

Regardless, initTM always makes SM download and trust the SMGR CA cert because SM always has SMGR-signed certs on its management interface for inter-process communication and DRS

If you go in inventory, pick your SM, and configure identity certs and check what the Common Name is of the SM100 cert - if it's "not your SMFQDN-SM100.yourdomain.com", then it'd be demo

Easy tip: go in firefox,

https://yourSM100IPaddress:5061

- you'll never get a webpage, but you will do a TLS handshake and be able to click the cert in the browser and see whats up

 

[RedTech443]

I checked under Manage Identity Certificates and see the following, but no FQDN names that I can see.

 

[RedTech443]

Sorry cannot seem to get my pic any larger for some reason...

 

[kyle555]

Yeah, so you select security module http or sip, scroll down or click view or something and it'll show you info about the certificate being used for the security module.

 

[RedTech443]

NO FQDN in that either. But looks default / demo

 

[kyle555]

Correct. So, you'd click replace with a CA signed certificate for both security module HTTP and SIP and SM would go get new certs from SMGR to use on those interfaces.

I hope you're in a lab and don't mind breaking things.

 

[RedTech443]

Looking at some of the options, I think I can simply "replace" it? Would I need to re-sync SM after using initDRS or something?

 

[RedTech443]

Thanks Kyle, yes it is all in a lab right now. I am trying to break stuff on purpose today !!

 

[RedTech443]

Replace this Certificate with Internal CA Signed Certificate Fails no matter what I enter for information.

I only get
"Error while generating CA signed certificate"

 

[kyle555]

check the management certificate and see if it's good?

I use that feature. Havent done it to flip from demo to CA signed before though... if you set the enrollment password and initTM -f it'll start from scratch