When the Identity Server is configured to use an SSL certificate that is signed externally, the trusted store of the embedded service provider for each component must be configured to trust this new CA. The browsers that are used to authenticate to the Identity Server must be configured to trust the CA that created the certificate for the Identity Server. If you obtain a certificate from a well-known external CA, most browsers are already configured to trust certificates from well-known CAs.
The following procedures explain how to use certificates signed by an external Certificate Authority.
The following sections explain how to create certificate signing requests for the Identity Server and Access Gateway, how to use the requests to obtain a signed certificates, then how to import the signed certificates and the root certificate of the Certificate Authority into Access Manager.
You need to create two certificate signing requests: one for the Identity Server and one for the Access Gateway. The and the need to be different, but the other values can be the same.
To create a signing request for the Identity Server:
In the Administration Console, click > > .
Select the option.
Fill the following fields:
Certificate name: idpa_test
Signature algorithm: Accept the default.
Valid from: Accept the default.
Months valid: Accept the default.
Key size: Accept the default.
Click the icon on the line.
Fill in the following fields:
Common name: idpa.test.novell.com
Organizational unit: o=novell
Organization: test
City or town: Provo
State or province: UT
Country: US
Click twice, then click the name of the certificate.
Click .
The signing request is saved to a file.
Repeat Step 1 through Step 7 to create a signing request for the Access Gateway. Use lag_test for the and lag.test.novell.com for the .
You can send the certificate signing request to a Certificate Authority and wait for the CA to return a signed certificate or you can use a trial certificate while you wait for the official certificate. Companies such as Thawte* and VeriSign* offer trial signed certificates.
Modify the following instructions for the CA you have selected to sign your certificates:
Set up an account with a Certificate Authority and select the free trial option.
Open your certificate signing request for the Identity Server in a text editor.
Copy and paste the text of the certificate request into the appropriate box for a trial certificate.
Click , then copy the signed certificate and paste it into a new text file or at the bottom of the signing request file.
Click , and repeat Step 2 through Step 4 for the Access Gateway.
Follow the instructions on the Web site to download the root certificate of the Certificate Authority.
The following steps explain how to imported the signed certificates and the trust root into the Administration Console so that they are available to be assigned to key stores and trusted root stores.
In the Administration Console, click r > > .
Click , then specify a name for the root certificate.
Click , and locate the root certificate file.
Click .
The trusted root is added and is now available to add to trusted root stores.
In a text editor, open the signed certificate for the Identity Server.
In the Administration Console, click r > , then click the name of certificate signing request for the Identity Server.
Click , then select .
Paste the text for the signed certificate into the data text box. Copy everything from
-----BEGIN CERTIFICATE-----
through
-----END CERTIFICATE-----
Click , then click the icon and locate the root certificate file.
Click .
The certificate is now available to be assigned to the keystore of a device.
If the certificate fails to import and you receive an error, it is probably missing a trusted root certificate in a chain of trusted roots. To determine whether this is the problem, see Resolving a -1226 PKI Error
and Importing an External Certificate Key Pair
in the Novell Access Manager 3.0 SP4 Administration Guide.
Repeat Step 5 through Step 10 for the Access Gateway certificate.
This section explains how to enable SSL between the Identity Servers and the browsers.
In the Administration Console, click > > .
For the protocol in the option, select .
In the line, click the icon.
In the section, click , then click the icon.
Select the Identity Server certificate, then click twice.
At the prompt to restart Tomcat, select to restart Tomcat now.
Click > .
Wait for the Identity Server health to turn green.
Click Access Gateway > > > .
In the section, click , then click the icon.
Select the trusted root certificate of the Certificate Authority that signed the Identity Server certificate.
Click until you return the Service Provider Certificates page.
IMPORTANT:If the external Certificate Authority writes the DN in reverse order (the cn element comes first rather than last), you receive an error message that the certificate names do not match. You can ignore this warning, if the order of the DN elements is the cause.
Click , then click the task.
Click .
Test the SSL connection between the browser and the Identity Server:
Enter the Base URL of the Identity Server in a browser.
https://idpa.test.novell.com:8443/nidp
If the URL returns a login page, log in using the credentials of a user in the LDAP server.
The user portal appears.
If the URL returns an error rather than displaying a login page, verify the following:
The browser trusts the CA that created the certificate.
The browser can resolve the DNS name of the Identity Server
The browser can access port 8443.
Verify that the trusted relationship between the Identity Server and the Access Gateway has been reestablished:
Enter the URL to a protected resource on the Access Gateway.
Complete one of the following:
If you are prompted for login credentials, enter them. The trusted relationship has been reestablished.
If you receive a 100101043 or 100101044 error, the trusted relationship has not been established. For information on solving this problem, see Troubleshooting 100101043 and 100101044 Liberty Metadata Load Errors
in the Novell Access Manager 3.0 SP4 Administration Guide.
This section explains how to enable SSL communication between the Access Gateway and the Identity Server (channel 3 in Figure 3-1) and between the Access Gateway and the browsers (channel 4 in Figure 3-1).
In the Administration Console, click > > > .
Select .
Select .
In the line, click the icon.
Select the Access Gateway certificate, then click .
IMPORTANT:If the external Certificate Authority writes the DN in reverse order (the cn element comes first rather than last), you receive an error message that the subject name does not contain the cn of the device. You can ignore this warning, if the order of the DN elements is the cause.
Click , then click .
This adds the trusted root of the Access Gateway certificate to the trusted root store of the Identity Server.
Specify an for the certificate, then click > .
On the Reverse Proxy page, click .
On the Server Configuration page, click .
In the section, click , and follow the prompts.
This imports the trusted root certificate of the Identity Server into the trusted root store of the embedded service provider.
Click twice to return to the Access Gateways page.
On the Access Gateways page, click .
Click > .
Verify that the trusted relationship between the Identity Server and the Access Gateway has been reestablished:
Enter the URL to a protected resource on the Access Gateway.
Complete one of the following:
If you are prompted for login credentials, enter them. The trusted relationship has been reestablished.
If you receive a 100101043 or 100101044 error, the trusted relationship has not been established. For information on solving this problem, see Troubleshooting 100101043 and 100101044 Liberty Metadata Load Errors
in the Novell Access Manager 3.0 SP4 Administration Guide.