SSL/TLS certificates are commonly used for both encryption and identification of the parties. In this blog post, I’ll be describing Client Certificate Authentication in brief. Client Certificate Authentication is a mutual certificate based authentication, where the client provides its Client Certif.

Generate CA key (ca-key.pem) and certificate (ca.pem)./cfssl gencert -initca ca-csr.json./cfssljson -bare ca Create a JSON config file for generating keys and certificates for the API server, for example, server-csr.json. Be sure to replace the values in angle brackets with real values you want to use.
Launch the Key Manager and generate the client certificate Go to Keys Client Keys tab and then click the Generate button. If you’ve tried setting up SFTP public key authentication on MFT Server before, this is exactly the same place where you create a SFTP key.

Every Code42 server includes a self-signed certificate to support secure HTTPS connections. That certificate enables encryption of client-server communications, but it cannot adequately identify your server and protect your clients from counterfeiters. This article describes how to configure a more secure option: using KeyStore Explorer to create an SSL/TLS certificate signed by a trusted certificate authority (CA).

Other articles describe other tools for creating a CA-signed certificate:

Linux administrators typically use OpenSSL.
Windows administrators typically use the Java keytool.

Server security requires a CA-signed certificate and the TLS protocol
Reliable security of any production web server requires an SSL certificate signed by a trusted certificate authority (CA) and enforced use of the TLS protocol (that is, HTTPS, not HTTP).

Your on-premises Code42 authority server is no exception. A Code42 server that is configured to use a signed certificate, strict TLS validation, and strict security headers protects server communications with browsers, your Code42 apps, and other servers.

By default, your authority server uses a self-signed certificate and TLS. That provides for encrypting client-server traffic.
Adding a CA-signed certificate provides further security by confirming your server's identity to clients. It prevents attackers from acquiring client data through counterfeit servers and encryption keys.
Never reconfigure a production server to use HTTP, rather than TLS and HTTPS.
Configuring Code42 servers and apps to use strict TLS validation further ensures the security of client-server connections.
Configuring Code42 servers to use an HTTPS Strict Transport Security (HSTS) response header further prevents unencrypted browser access to Code42 consoles.

Certificates and Java keystore files

The Code42 server accepts certificates bundled together in a Java KeyStore file. The keystore contains:

The certificate and the public and private key for the Code42 server
A certificate from the CA who signed the Code42 server certificate
Intermediate certificates that establish a chain of trust between the CA and the Code42 server certificate

Create the keystore using a utility such as KeyStore Explorer before applying it to the Code42 server from the Code42 console.

Build your keystore on any machine
You can generate keys and build keystores on any secure machine and then import the result, a *.jks file, to your authority server via the Code42 console. You do not need any further access to the authority server's host machine.

Before you begin

Before installing an SSL certificate, back up your Code42 server's database with a database dump so that you can recover it to a previous state if necessary. To create the dump:

Generate Client Certificate With Ca Keywords

Navigate to Settings > Server.
From the action menu, choose Dump Database.

Obtain the address of the CA to whom you will send your request for a signed certificate that verifies the validity of your keystore.
Install KeyStore Explorer if it is not already installed.
If you intend to import a certificate with an encryption key that exceeds the Java import limits on cryptographic algorithms, you must first configure your enterprise server to accept longer encryption keys.

Considerations

For multi-server Code42 environments, we recommend applying this process to all Code42 servers.
You must have the Server Administrator or SYSADMIN role to install an SSL certificate on your Code42 server.
This article assumes you are familiar with the following:
- The basic principles of Transport Layer Security (TLS)
- Configuring SSL certificates
The command-line utility OpenSSL is required if you are running Linux and want to reuse existing key materials.

Generate A Client Certificate

Assistance with creating your keystore
Assistance with the handling of a certificate signing request (CSR) or creating your keystore is beyond the scope of Customer Champions. For assistance, please contact your Customer Success Manager (CSM) to engage the Professional Services team.