ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.
Create, sign, and import an SSL certificate signed by a Trusted Certificate Authority for the Enforce Console Certificate
Article ID: 160518
Data Loss Prevention EnforceData Loss PreventionData Loss Prevention Enterprise SuiteData Loss Prevention Core Package
You need to create, sign, and import a signed SSL certificate for Symantec Data Loss Prevention (DLP) Enforce.
There are 2 main reasons one needs to import a certificate for use in the Enforce Console, as given below:
You wish to import a CA-signed certificate to allow most current browsers to automatically trust the Enforce Server administration console. The complete instructions for setting that up are given in the Windows and Linux Install Guides, in the section "About browser certificates".
You wish to enable certificate authentication that allows users to automatically log on to the Enforce Server administration console. The complete instructions for setting that up are given in the Admin Guide. v15.7, it is in Chapter 5, in the section "About certificate authentication configuration".
In Windows, all commands need to be executed via CMD with Admin access.
Command to see the hidden ".keystore" file on Linux: ls -la
As per the DLP Admin Guide (p. 151 in 15.7 version), the Tomcat store uses a X.509 certificate must be provided in Distinguished Encoding Rules (DER) format - which is a .cer file.
The instructions below involve chained certs, when the Root or Intermediate CAs are required - i.e., "the Signed" certificate. The format of using a .p7b file therefore applies in that instance - otherwise, the cert is unsigned, and one would simply import the .cer file.
Many CAs are issued in the form of chained certs, when the Root or Intermediate CAs are required in a chain that authenticates the signed certificate. Chained Cert format is a .p7b file extension. However, as noted above, current versions of Tomcat a file in DER format, extension of ".cer". In most cases, this means you have 3 .cer files, which can be imported one after the other into the Tomcat keystore file. You should import the higher level authority first (usually "root") , followed by all Intermediate CAs. Then import the signed certificate.
Back up existing keystore.
Windows command: copy <filepath>\.keystore<filepath>\keystore.bkup
It is important to note that the CSR should have all of the same arguments defined as the creation command. If this information is not defined, then the certificate you get back from your CA may not be valid.
The tomcat.csr can be created anywhere, but in this case we are creating it in our keytool directory.
Send tomcat.csr to CA admin, so they can generate a signed certificate file in the current format.
Copy the tomcat.cer chained cert file to the keytool directory <DRIVE>:\Program Files\Symantec\DataLossPrevention\ServerJRE\<version>\bin\.