When you install Snow Software® Commander®, a Secure Sockets Layer (SSL) certificate is installed to the apache-tomcat web server that confirms the identity of the server when your users access the system. This default certificate is self-signed, which means that your users have to make a decision whether or not to trust it when they access Snow Software Commander, because no certificate authority (CA) has validated the identity with a CA certificate.This means users will be prompted by their web browsers to make a decision, which will look like this:
Users can choose to trust the certificate or you can purchase and install a CA certificate that will be automatically trusted by web browsers, by following the procedures below.
Note: The instructions in this article were not prepared specifically for use with certificates that you already possess, or wild card certificates. You cannot skip any steps just because you already have a certificate, or else you may run into issues with the information in the web server not matching that encrypted information in the certificate. Modifications to the keystore or server.xml file to bypass this process are not supported by Embotics.
Remove the Default Self-Signed Certificate
The first thing that you must do is remove the default self-signed certificate that was created during the installation of Embotics vCommander, because there are no details uniquely identifying your organization. Before doing so, take a snapshot of the Embotics vCommander server so that you can restore to a known good state if anything goes wrong.
- On the Embotics vCommander server, open a command prompt and browse to <INSTALL DIRECTORY>\Embotics\vCommander\jre\bin.
- Issue the command keytool -delete -alias tomcat -keystore "C:\Program Files\Embotics\vCommander\tomcat\conf\keystore" -storepass changeit. If your path includes a space, you must enclose the path in quotes.
Generate a New Self-Signed Certificate
The next step is to install a new self-signed certificate which will contain details about your organization that must be shared with the certificate authority. This makes sure that when you create the signing request, all of your organization’s details are included in the tomcat web server.
- Still in the same directory used for the procedure above, issue the command
keytool -genkey -alias tomcat -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -validity 3650 -keystore "C:\Program Files\Embotics\vCommander\tomcat\conf\keystore" -storepass changeit .
- You are prompted to provide and confirm the information the certificate contains.
- First and Last Name: Enter the fully qualified domain name (FQDN) of the vCommander server. For example, vcommander.embotics.com.
- Organizational Unit: The name of your department within the larger organization. For example, Engineering.
- Organization: The name of your organization. For example, Embotics Corporation.
- City or Locality: The city where your organization is based. For example, Ottawa.
- State or Province: The state of province where your organization is based. For example, Ontario.
- Two-letter Country Code: The country where your organization is based. For example, CA for Canada or US for the United States of America. See a complete list.
- Key Password for Alias: Embotics does not recommend using a password, just strike the ENTER key to proceed past this prompt.
Create the Certificate Signing Request
The next step is to create a certificate signing request (CSR) file which you will submit to a certificate authority. This proves the identity of the server you are asking them to validate. Alternatively, you can use Active Directory Certificate Services as your authority.
Depending on the certificate authority you are working with, you will provide the CSR file either by uploading it via their customer service portal or emailing it to your sales representative. If you aren’t sure how to provide it to your certificate authority, contact their technical support or sales teams.
- Still in the same directory used for the procedure above, issue the command like one of the following examples:
keytool -certreq -keyalg RSA -alias tomcat -file embotics2017.csr -keystore "C:\Program Files\Embotics\vCommander\tomcat\conf\keystore" -ext san=dns:localhost,dns:sammy.pv.embotics.com,dns:sammy,ip:127.0.0.1,ip:10.10.10.78,ip:10.10.10.78 -storepass changeit.
keytool -certreq -keyalg RSA -alias tomcat -file embotics2017.csr -keystore "C:\Program Files\Embotics\vCommander\tomcat\conf\keystore" -ext san=dns:vcommander_FQDN.domain.com -storepass changeit.
If your path includes a space, you must enclose the path in quotes.
You must include at least one subject alternative name in order for Google Chrome 58 and later to work. To do so, replace the dns: and ip: values in this portion of the command, using the specifics that match your vCommander server. Examples:
san=dns:fqdn.yourvcommander.com,ip:xxx.xxx.xxx.xxx
san=dns:fqdn.yourvcommander.com
Use commas to add as many alternative names as you require.
When requesting a certificate, make sure that the certificate authority will provide one with SHA-2 or better encryption. Modern browsers no longer accept SHA-1 as secure.
- Retrieve the file certreq.csr created in the working directory and provide it to your certificate authority.
Some certificate authorities may store a copy of your CSR to allow for renewals without having to generate a new signing request. Some may also allow you to reuse your original CSR to renew certificates, providing there have been no relevant changes to the server's identity or naming.
Import the CA Signed Certificates
In this next step, you will import the certificate that was provided to you by the certificate authority. In most cases, you will have to install both an intermediate certificate as well as the one specific to the request that you submitted. If you do not install a certificate authority’s intermediate certificate when one is required, you will receive the following error when attempting to import the certificate for your request:
keytool error: java.lang.Exception: Failed to establish chain from reply
See the following articles for specific instructions related to installing intermediate certificate for particular certificate authorities:
- Save the .crt file provided to you by the certificate authority into the same directory used for the procedure above.
- Still in the same directory used for the procedure above, issue the command keytool -import -trustcacerts -alias tomcat -file yourfile.crt -keystore ..\..\tomcat\conf\keystore -storepass changeit using the correct filename for your .crt file. If your path includes a space, you must enclose the path in quotes.
- The message Certificate reply was installed in keystore indicates that the new certificate is installed and may be used. Restart the vCommander Windows service.
Important: If you receive the error message keytool error: java.security.cert.CertificateException: java.io.EOFException you most likely have a trailing space in your signed certificate. Open the certificate file in a text editor such as notepad and remove any spaces leading into or trailing the encrypted content, and import the certificate again.
Was this helpful?
0/255
Upload Attachment
File Upload
Maximum file
size allowed is 3 MB.
Supported file types:
Documents (.txt, .doc, .docx, .pdf), Images (.jpg, .png), Comma Separated Files
(.csv) Speadsheets (.xlsx, .xls)
Are you sure you want to cancel the case creation?
Case closed successfully
File Upload
Maximum file size allowed is 3 MB.
Supported file types:
Documents (.txt, .doc, .docx, .pdf), Images (.jpg, .png), Comma Separated Files
(.csv) Speadsheets (.xlsx, .xls)
Are you sure you want to close this case
| Products | Region | Phone Numbers |
|---|---|---|
| FlexNet Operations FlexNet Embedded FlexNet Publisher FlexNet Connect FlexNet Code Insight InstallAnywhere InstallShield |
North America * |
+1 630-332-2513 (toll) +1 877-279-2853 (toll-free in North America) |
| Europe * |
+44 1925 944367 (toll) +44 800 047 8642 (toll-free in Europe) |
|
| Japan * | +81 3-4540-5335 (select option 2) | |
| Australia * |
+61 3 9895 2177 +61 1800 560 603 (toll-free in Australia) |
|
|
Usage Intelligence (formerly
Revulytics) Compliance Intelligence |
Please use the Case Portal to submit your support ticket or reach out to your Revenera contact. | |
File Upload
Maximum file
size allowed is 3 MB.
Supported file types:
Documents (.txt, .doc, .docx, .pdf), Images (.jpg, .png), Comma Separated Files
(.csv) Speadsheets (.xlsx, .xls)
Case id: 00001065
Activity: Status change: 2 hours ago