Requirements

• Admin access to the Commander application server
• Ability to update DNS for TXT record validation
• Maintenance window to restart the Commander service

Installing Certbot on the Commander application server

1. Download Certbot and install it on the Commander application server.
2. Run the installer and complete the setup wizard.

Requesting the certificate using Certbot and DNS validation

1. Open cmd or PowerShell as an administrator.
2. Confirm Certbot is installed correctly by running:

   certbot -version

3. Log in to your DNS provider and create the TXT record for validation. Verify propagation using MXToolbox or Google Admin Toolbox before proceeding.
4. Run the following command, replacing the email and FQDN with your own:

   certbot --text --agree-tos --email you@domain.com -d commander.domain.com --manual --preferred-challenges dns --expand --renew-by-default --manual-public-ip-logging-ok certonly

5. Press ENTER to generate certificate files, which will be stored in the following directory, assuming the default installation path was used:

   C:\Certbot\archive\[FQDN]\
   

6. Copy these files to:

   ..\Embotics\Commander\tomcat\conf\
   

Configuring Commander to use the new SSL certificate

1. Back up your server.xml file in the same directory.
2. Open the original server.xml in a text editor.
3. Comment out the HTTP port 80 connector and any existing SSL connector entries.
4. Add a new connector specifying the certificate files, ensuring the .pem filenames match those in your \tomcat\conf directory:
   

   <Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="500" compression="on" scheme="https" SSLEnabled="true" secure="true">
   <SSLHostConfig protocols="TLSv1.2" ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA">
   <Certificate certificateFile="conf/cert.pem" certificateKeyFile="conf/privkey.pem" certificateChainFile="conf/chain.pem" />
   </SSLHostConfig>
   </Connector>

5. Save your changes and restart the Commander Windows service.
6. Once the service initializes, verify the new certificate. If it does not appear, clear your browser cache and check again.