Configuring Secure Communication - SSL

Procedure for Firewall Analyzer version 7.5 (Build 7500) onwards

How to find build number?

In the Firewall Analyzer web client, and click the About link in the top pane. You will find the build number mentioned below the build version. This is the build number of the currently installed Firewall Analyzer.

The SSL protocol provides several features that enable secure transmission of Web traffic. These features include data encryption, server authentication, and message integrity.

You can enable secure communication from web clients to the Firewall Analyzer server using SSL.

Procedure for Firewall Analyzer version 7.5 (Build 7500) onwards

• Generating a valid certificate
• Disabling HTTP
• Enabling HTPPS (SSL)
• Verifying SSL Setup
• Configuring HTTPS Configuration Parameters for 64 bit/128 bit encryption
• Using the existing SSL certificate
• How to install SSL certificate for Firewall Analyzer

Generating a valid certificate

Stop the server, if it is running.

Follow the instructions given below for SSL Installation:

If you have a keystore file for using HTTPS, place the file under <Firewall Analyzer Home>conf directory and rename it as "chap8.keystore"

Disabling HTTP

When you have enabled SSL, HTTP will continue to be enabled on the web server port (default 8080). To disable HTTP follow the steps below:

1. Edit the server.xml file present in <Firewall Analyzer Home>/conf directory.
2. Comment out the HTTP connection parameters, by placing the <!-- tag before, and the --> tag after the following lines:

Enabling HTPPS (SSL)

• In the same file, enable the HTTPS connection parameters, by removing the <!-- tag before, and the --> tag after the following lines: 
  <!-- <Connector port="8443"
  SSLEnabled="true"
  acceptCount="100"
  address="0.0.0.0"
  clientAuth="false"
  compressableMimeType="text/html,text/xml"
  compression="force"
  compressionMinSize="1024"
  connectionTimeout="20000"
  disableUploadTimeout="true"
  enableLookups="false"
  keystoreFile="./conf/test.keystore"
  keystorePass="firewall"
  maxSpareThreads="75"
  maxThreads="150"
  minSpareThreads="25"
  noCompressionUserAgents="gozilla, traviata"
  protocol="HTTP/1.1"
  scheme="https"
  secure="true"
  sslProtocol="TLS"
  URIEncoding="UTF-8"/>
  -->

Note:

While creating keystore file, you can enter the password as per your requirement. But ensure that the same password is configured, in the server.xml file. Example password is configured as 'firewall'.

Verifying SSL Setup

1. Restart the Firewall Analyzer server.
2. Verify that the following message appears in the command window after the Firewall Analyzer application is started:
   
   Server started.
   Please connect your client at https://localhost:8500

3. Connect to the server from a web browser by typing https://<hostname>:8500 where <hostname> is the machine where the server is running

Configuring HTTPS Configuration Parameters for 64 bit/128 bit encryption

If you want to configure the HTTPS connection parameters for 64 bit/128 bit encryption, add the following parameter at the end of the SSL/TLS Connector tag:

Using the existing SSL certificate 

• You can export the Wild card certificate to a .pfx file and then follow the instructions given below to configure the same in Firewall Analyzer.
• Stop ManageEngine Firewall Analyzer service
• Copy the .pfx file to the location <Firewall Analyzer Home>conf
• Go to the location <Firewall Analyzer Home>conf and open the file server.xml in word pad, and locate the entries in the file as below: 

• Replace the file name chap8.keystore with the pfx file name (<pfx file name>.pfx) and also enter the keystoreType="pkcs12" after the file name and also replace the keystorePass value 'rmi+ssl' with the password for the .pfx file.

• The entries should be as given below:

• Restart Firewall Analyzer service.

How to install SSL certificate for Firewall Analyzer

Follow the instructions given below for SSL Installation:

 Step 1: Create a new Keystore

1. You will be using the keytool command to create and manage your new Keystore file. When you are ready to create your keystore go to the directory where you plan to manage your Keystore and certificates (<Firewall Analyzer Home>jrebin). Enter the following command:

   keytool -genkey -alias <our_alias_name> or [Domain Name] -keyalg RSA -keystore chap8.keystore

   (For example: keytool -genkey -alias tomcat -keyalg RSA -keystore chap8.keystore)

2. You will be prompted to choose a password for your keystore. You will then be prompted to enter your Organization information. When it asks for first and last name, DO NOT mention your first and last name, but rather it is your Fully Qualified Domain Name for the site you are securing say, helpdesk.yourdomain.com. If you are ordering a Wildcard Certificate this must begin with the * character say, *.yourdomain.com)
3. After you have completed the required information confirm that the information is correct by entering 'y' or 'yes' when prompted. Next, you will be asked for your password to confirm. Make sure to remember the password you choose. Your keystore file named chap8.keystore is now created in your current working directory.

Step 2: Generate a CSR from your new keystore

1. Next, you will use keytool to create the Certificate Signing Request (CSR) from your Keystore. Enter the following command
   

   keytool -certreq -alias <your_alias_name> or [Domain Name] -file csr.txt -keystore chap8.keystore

   (For example: keytool -certreq -alias tomcat -file csr.txt -keystore chap8.keystore)

2. Type the keystore password that you chose earlier and hit Enter.
3. Your CSR file named csr.txt is now created in your current directory. Open the CSR with a text editor, and copy and paste the text (including the BEGIN and END tags) into the CA web order form. Be careful to save the keystore file (chap8.keystore) as your certificates will be installed to it later.

Step 3: How to install your SSL Certificate

1. Download your Certificate files from the email from CA to the directory where your keystore (chap8.keystore) was saved during the CSR creation process. The certificate must be installed to this exact keystore. If you try to install it to a different keystore it will not work. The certificates you downloaded must be installed to your keystore in the correct order for your certificate to be trusted. If the certificates are not installed in the correct order, then the certificate will not authenticate properly.
2. Install the Root Certificate file:
   • Each time you install a certificate to your keystore you will be prompted for the keystore password, which you chose when generating your CSR.
   • Type the following command to install the Root certificate file:

   keytool -import -trustcacerts -alias root -file TrustedRoot.crt -keystore chap8.keystore

   NOTE: Choose 'Yes' if you get prompted with a message that says "Certificate already exists in system-wide CA keystore under alias <entrustsslca> Do you still want to add it to your own keystore? [no]:" You will get a confirmation stating that the "Certificate was added to keystore".

3. Install the intermediate certificates if any. (Follow the instructions provided by the CA)
4. Install the Primary Certificate file:
   • Type the following command to install the Primary certificate file:

   keytool -import -trustcacerts -alias tomcat -file <your_domain_name>.crt -keystore chap8.keystore

   This time you should get a slightly different confirmation stating that the "Certificate reply was installed in keystore" If it asks if you want to trust the certificate. Choose y or yes. Your Certificates are now installed to your keystore file (keystore.key) and you just need to configure your server to use the keystore file.