The following procedure is for Private SSL Certificate.

1. Install the Certification Authority Server.
    

   When a Policy and the Master server is/are installed on the same system, the OfficeScan virtual website is shared meaning both Policy and Master server is using the same folder. Follow the procedure below when you have both Policy and Master server installed on the same machine.
2. Create a Certificate Signing Request (CSR).
   This procedure will make your OfficeScan web console inaccessible since there is no SSL certificate being used.
   1. Open the IIS Manager. From the Start button select Programs > Administrative Tools > Internet Information Services Manager.
   2. In IIS Manager, double-click the local computer.
   3. Select OfficeScan, then right-click Properties. Select the Directory Security tab, and then click the Server Certificates button in the Security section of the menu. This starts the Web Server Certificate Wizard.

      

   4. Click Next to continue.

      

   5. Select Remove the current certificate, then click Next to continue.
      OfficeScan has a default SSL certificate which is a 1024 bit length for the encryption level. Use the 2048 bit length encryption level. Since OfficeScan has a default SSL certificate, there will be no option in creating a new certificate. You need to remove the current certificate and replace it with a new one with 2048 bit length encryption level.

      

      

   6. Removing the certificate does not totally delete the certificate from its list. Click Finish to confirm certificate removal.

      

   7. Again, click the Server Certificates button then click Next. Select Create a new certificate, then click Next to continue.

      

   8. Select Prepare the request now, but send it later. Click Next to continue.

      

   9. In the Bit Length field, select 2048 for the encryption level, then tick Select cryptographic service provide CSP for this certificate. Click Next.

      

   10. From the Available Providers window, select Microsoft RSA SChannel Cryptographic Provider, and then click Next.

       

   11. Enter the legal name of your Organization and Organization Unit, which is the department within your organization. Click Next.

       

   12. In the Common name field, enter the NetBIOS, FQDN or the IP address of the server. Click Next.
       This should be used in TMMS’ communication settings between your Master and Policy Server.

       

   13. Enter the Country/Region, State/Province, and City/locality of your organization. Click Next to continue. In the Certificate Request File Name window, save the CSR to your computer. Take note of the location and filename.

       

       

   14. Review the information for the certificate request in the Request File Summary window. To make revisions, click Back or click Next, then click Finish.
       

       

1. Go to Administrative > Certification Authority.
2. Right-click the server name, and then select All Tasks > Submit new request. Locate and select the CSR created.

   

   

3. Go to Pending Requests. Right-click the request and then select Issue. The request will immediately disappear and will and will reappear under Issued Certificates.

   

   

4. Export the child certificate. Double-click on the newly signed and issued certificate then the Certificate Wizard opens. Click the Details tab then click the Copy to file button. The Certificate Export Wizard appears.

   

5. Click Next.

   

6. Select DER encoded binary X.509 (.CER), and then click Next. Save the file to a target directory and name it as “Child-CA.cer”, so that it can be distinguished as the child certificate.

   

7. Click Next.

   

8. Verify the information then click Finish. A window appears saying the export was successful. Click OK to close the window.

   

9. Export the root certificate. On the same Certificate window click Certification Path then select the root certificate. Click View Certificate.

   

10. Click the Details tab and click Copy to File button. The Certificate Export Wizard appears then click Next to continue. Select the DER encoded binary X.509 (.CER) option, and then click Next.

    

11. Save the file to a target directory and name it as “Root-CA.cer” so that it can be distinguished as the root certificate. Verify the information and click Finish.

    

    A window should appear saying that the export was successful. Click Finish to close the windows.

    

1. Open IIS Manager and then right-click OfficeScan, and then select Properties.
2. Go to Directory Security tab and then click Server Certificate. At this point since there is no certificate used by OfficeScan virtual website, the View Certificate button will be greyed-out.

   

3. Click Server Certificate > Next. Click Process pending request and install the certificate > Next.

   

4. Locate and select the child certificate and then when prompted for the SSL port, set it to 4343.

   

5. Click Next.

   

6. Review and verify information. Click Finish to complete the request.

   

   Click Finish to close all windows.

   

7. Restart the OfficeScan virtual website to make sure that the changes take effect.

   You should be able to access the OfficeScan management console.Tthis means that the self-signed certificate has been binded to the OfficeScan virtual website

   The example below will show you the difference between when accessing the web console through IP address and FQDN.

   

   When using the IP address it will no longer prompt a certificate error and will show you a lock icon right after the address bar. This is due to the site’s common name is the IP address. As for the FQDN, when accessing the web console it will still prompt a certificate error and no lock icon.

   Please be sure of what to use on your site’s common name. In any case that you wish to revert to FQDN or NetBIOS name, you need to redo all the steps above.

   

For Public SSL certificate:

1. Follow the instructions the public issuer’s web site on how to submit a certificate signing request. This has the same steps on how to create a CSR.
2. After submitting and receiving the signed CSR, follow the steps provided by the issuer on how to apply the signed certificate on a specific operation system.

1. Open IIS Manager then right-click OfficeScan.
2. Go to Directory Security tab. Click the Server Certificate button.
3. Click Export the current certificate to a .pfx file > Next. Select a target directory and filename.

   

4. Select a target directory and filename.

   

5. Enter the password and click Next. Review and verify the information.

   

6. Click Next > Finish to complete the export.

   

7. Upload the certificate. For more information, refer to the following topic from the Installation and Deployment Guide:Trend Micro Mobile Security – Client Profile Signing Credentials.

1. Install the root certificate on your computer:
   1. Double-click the root certificate.
   2. On the Certificate window, click Install Certificate.
   3. On the welcome screen, click Next.
   4. Keep the default settings, and then click Next.
   5. Click Finish to start the installation. A pop up message displays notifying that the certificate import was successful.
2. Download and install the iPhone Configuration Utility.
3. Create a Profile for iOS mobile devices:
   1. Start the iPhone Configuration Utility.
   2. Click Configuration Profiles from the Library list on the left pane.
   3. Click New to add a new profile in the profiles list.
   4. Select the new profile that you have created, and then select Credentials on the center pane.
   5. Click Configure on the Configure Credentials found on the right pane. The Personal Certificate Store displays.
   6. Select the root certificate from the list, and then click OK.
   7. Click General on the center pane, and then type the necessary information in the fields provided on the Identity area.
4. Install the profile on the iOS mobile device by:
   1. Connect the iOS mobile device to the computer where you have installed the root certificate.
   2. Select the iOS mobile device from the
   3. Devices
   4. list on the left pane.
   5. On the Configuration Profiles tab, select the profile you just created, and then click Install. The iPhone Configuration Utility pushes the profile to the mobile device.
   6. On the mobile device, tap Install on the Install Profile screen.
   7. Tap Install Now on the Root Certificates pop message. The profile installation starts.
   8. After the profile is installed, tap Done on the Profile Installed screen.