{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":30365,"path":"it-operations-management/event-management/create-keys-and-certificates.md","title":"Create keys and certificates","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create keys and certificates\n\nCreate keys and certificates in your root directory to enable Transport Layer Security \\(TLS\\) setup. TLS setup is required before you can configure mTLS on the MID Web Server and agent.\n\n## Before you begin\n\n-   Ensure that there are no keys installed in the MID unified keystore by running the following command:\n\n    ```\n    bin/scripts/manage-certificates.(sh/bat) -l\n    ```\n\n    When there are no keys installed, the output is: `defaultsecuritypairhandle`\n\n-   Invalidate your MID Server.\n\n    If additional keys exist in the output, reinstall those keys after invalidating the MID Server.\n\n-   Ensure that the MID Server is connected to the instance.\n-   Select a directory in which you want to create certificates, to be called the **root** directory.\n-   For Windows environments only: Install [Win32/Win64 OpenSSL](https://slproweb.com/products/Win32OpenSSL.html) with all dependencies and ensure it is on the system `PATH`.\n\n**Note:** This procedure includes commands for both CentOS 7/Linux and Windows Server environments. Select the commands relevant for your host operating system. If working with another Linux distribution, adapt the commands as needed for your specific OS.\n\nRole required: agent\\_client\\_collector\\_admin\n\n## Procedure\n\n1.  In a Linux environment:\n\n    1.  Create subdirectories for your certificates in your root directory.\n\n        ```\n        mkdir -p labca labmid labacc;\n        ```\n\n    2.  Generate the EC key pair.\n\n        ```\n        openssl ecparam -list_curves;\n        openssl ecparam -out labca/ec-labcakey.pem -name prime256v1 -genkey; \n        ls labca/;\n        ```\n\n        The generated output is the `ec-labcakey.pem` file.\n\n    3.  Create the root CA certificate.\n\n        ```\n        openssl ecparam -in labca/ec-labcakey.pem -text -noout; \n        openssl req -x509 -new -nodes -key labca/ec-labcakey.pem -sha512 -days 365 -out labca/labcacert.pem -subj \"/C=<country>/ST=<state>/L=<location>/O=<organization> Lab/OU=<organization unit>/CN=<cn abbreviation>\"; \n        openssl verify labca/labcacert.pem;\n        ```\n\n        Generated output:\n\n        -   `labca/labcacert.pem: C = <country>, ST = <state>, L = <location>, O = <organization> Lab, OU = <organization unit>, CN = <cn abbreviation>`\n        -   `OK`\n    4.  Import the CA certificate into the system trust store.\n\n        ```\n        sudo cp -a labca/labcacert.pem /etc/pki/ca-trust/source/anchors/;\n        sudo update-ca-trust extract;\n        openssl verify labca/labcacert.pem\n        ```\n\n        Generated output: `labca/labcacert.pem: OK`\n\n    5.  Obtain the fully qualified domain name \\(FQDN\\) for the host.\n\n        ```\n        hostname --all-fqdns;\n        ```\n\n    6.  Generate the server certificate signing request \\(CSR\\) and sign it with the CA.\n\n        Enter the FQDN as the `<hostname>` value in the following commands. If more than one FQDN value is returned, use the value with the following format: `hostname.domain.domain.com`.\n\n        ```\n        openssl req -new -newkey rsa:4096 -keyout labmid/rsa-labmidkey.pem -sha512 -nodes -out labmid/mid.csr -subj \"/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<hostname>\";\n        openssl x509 -req -days 365 -in labmid/mid.csr -CA labca/labcacert.pem -CAkey labca/ec-labcakey.pem -CAcreateserial -extensions SAN -extfile <(cat /etc/pki/tls/openssl.cnf <(printf \"\\n[SAN]\\nsubjectAltName=DNS:<hostname>\")) -out labmid/mid.crt;\n        ```\n\n        Generated output:\n\n        ```\n        Signature ok\n        subject=/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<mid server host fqdn>\n        Getting CA Private Key\n        ```\n\n    7.  Combine the key and certificate files into one file, named `mid.pem`.\n\n        ```\n        cat labmid/rsa-labmidkey.pem labmid/mid.crt > labmid/mid.pem;\n        ```\n\n2.  In a Windows environment:\n\n    1.  Create subdirectories for your certificates in your root directory.\n\n        ```\n        mkdir labca labmid labacc\n        ```\n\n    2.  Generate the EC key pair.\n\n        ```\n        openssl ecparam -list_curves\n        openssl ecparam -out labca\\ec-labcakey.pem -name prime256v1 -genkey\n        dir labca\n        ```\n\n        The generated output is the `ec-labcakey.pem` file.\n\n    3.  Create the root CA certificate.\n\n        ```\n        openssl ecparam -in labca\\ec-labcakey.pem -text -noout\n        openssl req -x509 -new -nodes -key labca\\ec-labcakey.pem -sha512 -days 365 -out labca\\labcacert.pem -subj \"/C=<country>/ST=<state>/L=<location>/O=<organization> Lab/OU=<organization unit>/CN=<cn abbreviation>\"\n        openssl verify labca\\labcacert.pem\n        ```\n\n        Generated output: `C=<country>, ST=<state>, L=<location>, O=<organization> Lab, OU=<organization unit>, CN=<cn abbreviation>`\n\n    4.  Import the CA certificate into the system trust store.\n\n        ```\n        certutil -addstore -f \"Root\" labca\\labcacert.pem\n        openssl verify -CAfile labca\\labcacert.pem labca\\labcacert.pem\n        ```\n\n        Generated output: `labca/labcacert.pem: OK`\n\n    5.  Obtain the fully qualified domain name \\(FQDN\\) for the host.\n\n        ```\n        net config workstation | findstr /C:<Full Computer name>\n        ```\n\n        The `Full Computer name` value returned is the FQDN to use as the `<hostname>` later in this procedure.\n\n    6.  Create the SAN \\(Subject Alternative Name\\) configuration file.\n\n        ```\n        copy \"%ProgramFiles%\\OpenSSL-Win64\\bin\\cnf\\openssl.cnf\" openssl-san.cnf\n        echo.>>openssl-san.cnf\n        echo [SAN]>>openssl-san.cnf\n        echo subjectAltName=DNS:<hostname>>>openssl-san.cnf\n        ```\n\n        Adjust the source `openssl.cnf` path to match your OpenSSL installation location if it differs from the default.\n\n    7.  Generate the server certificate signing request \\(CSR\\) and sign it with the CA.\n\n        Enter the FQDN as the `<hostname>` value in the following commands. If more than one FQDN value is returned, use the value with the following format: `hostname.domain.domain.com`.\n\n        ```\n        openssl req -new -newkey rsa:4096 -keyout labmid\\rsa-labmidkey.pem -sha512 -nodes -out labmid\\mid.csr -subj \"/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<hostname>\"\n        openssl x509 -req -days 365 -in labmid\\mid.csr -CA labca\\labcacert.pem -CAkey labca\\ec-labcakey.pem -CAcreateserial -extensions SAN -extfile openssl-san.cnf -out labmid\\mid.crt\n        ```\n\n        Generated output:\n\n        ```\n        Signature ok\n        subject=/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<mid server host fqdn>\n        Getting CA Private Key\n        ```\n\n        **Note:** With OpenSSL 3.x \\(the Win32/Win64 installer\\), the `Getting CA Private Key` line may not appear in the output, but `Signature ok` and the correct `subject=` line are still present. To confirm the certificate was signed correctly, verify `labmid\\mid.crt` directly:\n\n        ```\n        openssl x509 -in labmid\\mid.crt -noout -subject -dates\n        ```\n\n        This command shows the subject you specified and valid `notBefore`/`notAfter` dates.\n\n    8.  Combine the key and certificate files into one file, named `mid.pem`.\n\n        ```\n        copy /b labmid\\rsa-labmidkey.pem+labmid\\mid.crt labmid\\mid.pem\n        ```\n\n\n## What to do next\n\n[Set up the MID Web Server with a .pem file](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/set-mid-web-server.md).\n\n"}}