- Create a backup of the /etc/pki/tls/openssl.cnf file.
- Edit /etc/pki/tls/openssl.cnf with the following:
- Under [CA_default]
dir = /etc/pki/CA # where everything is kept
Extension copying option: use this with caution
copy_extensions = copy - Under [req]
req_extensions = v3_req - Under [v3_req]
subjectAltName = @alt_names
[alt_names]
DNS.1 = servermx1.domain.com
DNS.2 = servermx2.domain.com
- Under [CA_default]
- Create an empty index.txt file in the /etc/pki/CA directory using this command:
[root@imsva80b ~]# touch /etc/pki/CA/index.txt
- Create the serial file with initial content in the /etc/pki/CA directory using this command:
[root@imsva80b ~]# echo "01" > /etc/pki/CA/serial
- Generate the TLS certificate using the following commands:
openssl req -x509 -newkey rsa:1024 -keyout /tmp/root_key.pem -out /tmp/root_req.pem
Note: Imsva_req.pem is the certificate with multiple “Subject Alternative Name”.
openssl genrsa -out /tmp/imsva_key.pem 1024
openssl req -new -key /tmp/imsva_key.pem -out /tmp/imsva_req.pem - Check the certificate using the following command:
openssl req -text -noout -in /tmp/imsva_req.pem
- If the certificate is properly created, you will see the contents of the certificate in encrypted form.
- If the certificate was not created properly, you will see error messages after executing the command.
- Sign the certificate using the following command:
openssl ca -days 365 -cert /tmp/root_req.pem -keyfile /tmp/root_key.pem -in /tmp/imsva_req.pem -out /tmp/imsva_cert.pem -outdir /tmp
Using the configuration from /etc/pki/tls/openssl.cnf, enter the password for /tmp/root_key.pem: trend.
'trend' may be any password that you want to use.
For IMSVA 9.0
- Go to Administration > IMSVA Configuration > Transport Layer Security.
The Transport Layer Security (TLS) screen appears with the Messages Entering IMSVA tab displayed by default.
- Click the SMTP and HTTPS Certificatestab.
The SMTP and HTTPS Certificates screen appears.
- Under the SMTP and HTTPS Certificate List, click Add.
The Add Certificate screen appears.
- Configure the settings.
Refer to page 13-4, 13-5 and 13-6 of the IMSVA 9.0 Administrator’s Guide for more details.
- Generate the TLS certificate using the following commands:
openssl req -x509 -newkey rsa:1024 -keyout /tmp/root_key.pem -out /tmp/root_req.pem
openssl genrsa -out /tmp/imsva_key.pem 1024
openssl req -new -key /tmp/imsva_key.pem -out /tmp/imsva_req.pemImsva_req.pem is the certificate with multiple “Subject Alternative Name”.
- Check the certificate using the following command:
openssl req -text -noout -in /tmp/imsva_req.pem
- If the certificate is properly created, you will see the contents of the certificate in encrypted form.
- If the certificate was not created properly, you will see error messages after executing the command.
- Bring the output PEM to the third-party company for signing.