AZT SSL Certificate Generation + Application (AWS)

Modified on Tue, 4 Aug at 10:00 AM

TABLE OF CONTENTS

Overview
Request an SSL Certificate in AWS Certificate Manager
Apply an SSL Certificate

Overview

Use the directions below to request an SSL certificate for a Trustcenter hosted in AWS, and to apply that certificate to the Trustcenter.

For a Trustcenter in AWS, the certificate is requested through AWS Certificate Manager (ACM) rather than by generating a certificate signing request on the Trustcenter itself.

Request an SSL Certificate in AWS Certificate Manager

Login to the AWS console.
Use the navigation bar to search for AWS Certificate Manager (ACM).
Select Request certificate on the left side of the ACM dashboard.
Choose Request a public certificate, then click Next.
Fill in the certificate request configuration:
- Domain names: enter the fully qualified domain name of your Trustcenter, for example example.ariacybersecurity.com.
- Allow export: select Enable export. This is required, because the private key must be exportable in order to apply the certificate to the Trustcenter. ACM charges for the requested domains when an exportable certificate is first issued and at each renewal.
- Validation method: select DNS validation (recommended) if you are able to modify the DNS configuration for the domain, otherwise select Email validation.
- Key algorithm: RSA 2048.
- Tags: optional.
Once completed, select Request.
After the request is validated and the certificate is issued, export the certificate. The export provides the certificate body, the certificate chain, and the private key, and prompts you to set a passphrase for the private key. Keep that passphrase; it is required in the next section.
Apply the certificate using the section below, or provide the exported files to ARIA Technical Support at aria_support@ariacybersecurity.com for application.

Apply an SSL Certificate

Login to the Trustcenter UI and navigate to Settings > System Settings > General.
Enable the SSH service. Click Apply Now.

Secure copy the exported certificate files to the Trustcenter.

scp certificate.pem certificate_chain.pem private_key.pem <user>@trustcenter:/home/user/

SSH to the Trustcenter as the user created during post-install and elevate to the root user.
```
ssh <user>@trustcenter
$ sudo su -
[sudo] password for user:
root@aria-azt-trustcenter:~#
```

Move the certificate files to the root directory.

mv /home/user/certificate.pem /home/user/certificate_chain.pem /home/user/private_key.pem /root

Unload the Self-Protect Agent.
```
rmmod AztAgent
```

Create the SSL directory and move/copy the certificate contents to it.

mkdir /trustcenter/ca/thirdparty
mv certificate.pem /trustcenter/ca/thirdparty/server.pem
mv certificate_chain.pem /trustcenter/ca/thirdparty/ca-chain.pem
cp private_key.pem /trustcenter/ca/thirdparty/server.key

Create a passwords.txt and add the private key passphrase to it.
```
echo '<passphrase>' > /trustcenter/ca/thirdparty/passwords.txt
```

Update permissions.

chmod 770 /trustcenter/ca/thirdparty
chmod 770 /trustcenter/ca/thirdparty/*

Restart the Trustcenter UI container.
```
docker restart trustcenter-proxy-1
```
Reload the Self-Protect Agent.
```
modprobe AztAgent
```
Navigate to the Trustcenter UI and confirm the SSL certificate is in place.

If you have any questions or run into issues, please contact support.