Dell Data Protection | Encryption Manuel d'utilisateur télécharger pdf (Page 43)

Enterprise Server Installation and Migration Guide 43

Dell Security Server in DMZ Mode Configuration

If the Dell Security Server is deployed in a DMZ and a private network, and only the DMZ server has a domain certificate from a

trusted Certificate Authority (CA), some manual steps are needed to add the trusted certificate into the Java keystore of the

private network Dell Security Server.

If a trusted certificate is being used, omit this section and continue to

APNs Enrollment

NOTE: We highly recommend the use of domain certificates from a trusted Certificate Authority for both DMZ and

private network servers.

Use Keytool to Import the DMZ Domain Certificate

IMPORTANT: Backup the existing Dell Security Server cacerts before continuing with the Keytool instructions.If a

configuration error is made, you can revert back to the saved file.

Assumptions

• Dell Security Server was installed with an untrusted certificate.

• Dell Security Server in DMZ Mode was installed using a signed certificate (Entrust, Verisign, etc.)

•A .pfx certificate file is available. If your certificate needs to be converted to .pfx, see How to Export a Certificate to .PFX Using

the Certificate Management Console.

Process

Add Keytool to the system path.

set path=%path%;<Dell Java Install Dir>\bin

Use Keytool to list the contents of the trusted domain certificate that you want to import. Take note of the Alias Name listed.

keytool -list -v -keystore “C:\<path-to-pfx>\SignedCert.pfx -storetype PKCS12

Use Keytool to import the contents of the signed certificate into the Dell Security Server’s cacerts file:

keytool -importkeystore -v -srckeystore "C:\<path-to-source-file>\SignedCert.pfx"

-srcstoretype PKCS12 -srcalias AliasName -destkeystore "C:\<path-to-dest-cacert>\cacerts"

-deststorepass changeit -destalias AliasName -destkeypass changeit

For -srcalias, you will need to gather this information from the exported contents of the signed certificate.

For -destalias, this can be any location you choose.

Backup and replace the current cacerts file in the <Security Server install dir>\conf\ directory with this newly created cacerts

file on the Dell Security Server.

Modify application.properties File

Modify the application.properties file to specify the alias of the signing cert.

Go to

<Security Server install dir>\conf\application.properties

Modify the follow information:

keystore.alias.signing=<Change this value to the value of step 3 above for

-destalias

Restart the Dell Security Server Service.

Continue to

APNs Enrollment

1 2 ... 38 39 40 41 42 43 44 45 46 47 48 ... 79 80

Pas de commentaire

Dell Data Protection | Encryption Manuel d'utilisateur Page 43