To request a signed SSL certificate from a certificate authority, a CSR file must be provided. This article provides the steps on how to create a signed SSL cert on JSA appliances. The steps to implement the signed certificate on the JSA device is included too.
Note: The following example is for appliances which have the WebUI access enabled and specifically with 2014.8 version code. Changes in more recent code have been noted below. This corresponds to JSA console and AIO installations. Other installation options, such as EP, FP, EC, FC, EP-FP combo, do not require a signed SSL certificate since they do not have WebUI access. For more information on this example, refer to the s ection SSL Certificate Replacement in the Administration guide.
# openssl following -nodes -newkey rsa:bits_value -keyout arg -out [arg] Example: openssl req -nodes -newkey rsa:2048 -keyout this_server.key -out CSR_key.csr where CSR_key.csr is the name of the file
# openssl following -nodes -newkey rsa:bits_value -keyout arg -out [arg]
Example: openssl req -nodes -newkey rsa:2048 -keyout this_server.key -out CSR_key.csr where CSR_key.csr is the name of the file
openssl req -nodes -newkey rsa:2048 -keyout this_server.key -out CSR_key.csr
CSR_key.csr
Example: [root@JSA_3800]# openssl req -nodes -newkey rsa:2048 -keyout this_server.key -out CSR_key.csr Generating a 2048 bit RSA private key ..........................+++ .............................+++ writing new private key to 'this_server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:US State or Province Name (full name) []:California Locality Name (eg, city) [Default City]:Sunnyvale Organization Name (eg, company) [Default Company Ltd]:Juniper Organizational Unit Name (eg, section) []:JSA Common Name (eg, your name or your server's hostname) []:VJSA Email Address []:[email protected] Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:JuniperNetworks! An optional company name []:jnpr [root@JSA_3800_]#
[root@JSA_3800]# openssl req -nodes -newkey rsa:2048 -keyout this_server.key -out CSR_key.csr Generating a 2048 bit RSA private key ..........................+++ .............................+++ writing new private key to 'this_server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:US State or Province Name (full name) []:California Locality Name (eg, city) [Default City]:Sunnyvale Organization Name (eg, company) [Default Company Ltd]:Juniper Organizational Unit Name (eg, section) []:JSA Common Name (eg, your name or your server's hostname) []:VJSA Email Address []:[email protected] Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:JuniperNetworks! An optional company name []:jnpr [root@JSA_3800_]#
[root@JSA_3800]# openssl req -nodes -newkey rsa:2048 -keyout this_server.key -out CSR_key.csr Generating a 2048 bit RSA private key ..........................+++ .............................+++ writing new private key to 'this_server.key'
----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:US State or Province Name (full name) []:California Locality Name (eg, city) [Default City]:Sunnyvale Organization Name (eg, company) [Default Company Ltd]:Juniper Organizational Unit Name (eg, section) []:JSA Common Name (eg, your name or your server's hostname) []:VJSA Email Address []:[email protected] Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:JuniperNetworks! An optional company name []:jnpr [root@JSA_3800_]#
/etc/pki/tls/
[root@JSA_3800 tls]# ls cert.pem certs misc this_server.key openssl.cnf private CSR_key.csr
Via a root CLI connection, access the appliance where the SSL certificate is to be installed. Type the following command: /opt/qradar/bin/install_ssl_cert.sh -i (in versions 7.3 and higher the script name changed to install-ssl-cert.sh) Type the directory path ... a: Of your private/public key file. OR b. If you are using an intermediate certificate, type the directory path for your intermediate certificate. Note: Do not encrypt the private key when you install or replace an SSL certificate. Type Y to accept. Press Enter to continue.
/opt/qradar/bin/install_ssl_cert.sh -i (in versions 7.3 and higher the script name changed to install-ssl-cert.sh)
service hostcontext restart For versions of code 7.3 and higher, use the command 'systemctl restart hostcontext'. The SSL certificate will be implemented on the JSA appliance.
service hostcontext restart
2019-08-28: Corrected the restart commands to reflect the current software release; additional minor format changes. 2019-10-29: Added clarification, new command/script information for 7.3 code, removed old links to docs.