Replacing the web console certificate with customer PKCS #12 format in IWSVA 6.5

You need to modify the server.xml file after uploading the certificate when using this method.

1. Open the IWSVA web console.
2. Go Administration > Network Configuration > web console.
3. Choose SSL mode.
4. Upload your certificate (e.g. Cert.pfx or Cert.p12).
5. Set the password.
6. Click Save.
   You will find that the web console cannot be opened.
7. Log on to the IWSVA server using the "root" account via the command line.
8. Navigate to the /usr/iwss/AdminUI/tomcat/conf/ folder.
9. Modify the server.xml file by adding the "keystoreType="pkcs12"" entry for port 8443 and port 9091.

   <Connector port="8443" connectionLinger="60000" URIEncoding="UTF-8" protocol="org.apache.coyote.http11.Http11Protocol" maxHttpHeaderSize="8192" maxThreads="15" minSpareThreads="3" maxSpareThreads="8" enableLookups="true" disableUploadTimeout="true" connectionTimeout="900000" acceptCount="100" scheme="https" secure="true" clientAuth="false" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" keystoreType="pkcs12" keystoreFile="keystore" keystorePass="password" SSLEnabled="true"/>
   <Connector port="9091" connectionLinger="60000" URIEncoding="UTF-8" protocol="org.apache.coyote.http11.Http11Protocol" maxHttpHeaderSize="8192" maxThreads="15" minSpareThreads="3" maxSpareThreads="8" enableLookups="true" disableUploadTimeout="true" connectionTimeout="900000" acceptCount="100" scheme="https" secure="true" clientAuth="false" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" keystoreType="pkcs12" keystoreFile="keystore" keystorePass="password" SSLEnabled="true"/>

    

   When editing the server.xml file, do not use copy and paste into notepad as it may cause illegal character.
10. Restart the web console using the following command:

    # /etc/iscan/S99IScanHttpd restart

You should be able to open web console again and use the uploaded certificate.

Change the PKCS #12 certificate to JKS format first before importing it into IWSVA:

1. Use "root" to log on to the IWSVA via command-line.
2. Navigate to the /usr/iwss/AdminUI/jre/bin folder.
3. Upload your certificate (e.g. Cert.pfx or Cert.p12) to the /usr/iwss/AdminUI/jre/bin folder.
4. Run the command below:

   ./keytool -importkeystore -srckeystore Cert.pfx -srcstoretype pkcs12 -destkeystore cert.jks -deststoretype jks

   You can also use the same command to convert Cert.p12 into cert.jks.
5. Enter the destination and source keystore password. Please make sure both destination\source passwords are the same.
6. Download the generated cert.jks to the customer's local disk.
7. Open the IWSVA web console.
8. Go to Administration > Network Configuration > web console.
9. Choose SSL mode.
10. Upload the generated cert.jks file.
11. Set the password.
12. Click Save.
13. Wait for a few minutes for the new settings to take effect.
14. Log on to the web console.

The certificate should now be replaced successfully.