ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.
Create, sign, and import an SSL certificate signed by a Trusted Certificate Authority for the Enforce Console Certificate
Article ID: 160518
Data Loss Prevention EnforceData Loss PreventionData Loss Prevention Enterprise SuiteData Loss Prevention Core Package
You need to create, sign, and import a signed SSL certificate for Symantec Data Loss Prevention (DLP) Enforce.
There are 2 main reasons one needs to import a certificate for use in the Enforce Console, as given below:
You wish to import a CA-signed certificate to allow most current browsers to automatically trust the Enforce Server administration console. The complete instructions for setting that up are given in the Windows and Linux Install Guides, in the section "About browser certificates".
You wish to enable certificate authentication that allows users to automatically log on to the Enforce Server administration console. The complete instructions for setting that up are given in the About certificate authentication configuration article.
In Windows, all commands need to be executed via CMD with Admin access.
Command to see the hidden ".keystore" file on Linux: ls -la
As per the DLP Admin Guide (p. 151 in 15.7 version), the Tomcat store uses a X.509 certificate must be provided in Distinguished Encoding Rules (DER) format - which is a .cer file.
The instructions below involve chained certs, when the Root or Intermediate CAs are required - i.e., "the Signed" certificate. The format of using a chained certificate file therefore applies in that instance - otherwise, the cert is unsigned, and one would simply import the .cer file.
Many CAs are issued in the form of chained certs, when the Root or Intermediate CAs are required in a chain that authenticates the signed certificate. Chained cert format should be X509 compliant and presented as a .pem file extension to be used successfully in this particular keystore.
Back up existing keystore.
Windows command: copy <filepath>\.keystore<filepath>\keystore.bkup
It is important to note that the CSR should have all of the same arguments defined as the creation command. If this information is not defined, then the certificate you get back from your CA may not be valid.
The tomcat.csr can be created anywhere, but in this case we are creating it in our keytool directory.
Send tomcat.csr to CA admin, so they can generate a signed certificate file in the current format. You should request an X509 compliant, chained certificate - this will likely have the .pem file extension. (Note that p7b will not work in this particular keystore.)
Copy the tomcat.cer chained cert file to the keytool directory <DRIVE>:\Program Files\Symantec\DataLossPrevention\ServerJRE\<version>\bin\.