Encrypt Communication with Browser, (Enterprise) Command Center, and Passive Sensors
The /etc/default/silentdefense-cc file stores the location of the Java keystore to be used for this scenario (similarly to the <Tomcat config> in the single keystore scenario).
Snippet of the default Command Center configuration file:
export DEFAULT_OPTS="-server \ -Djavax.net.ssl.keyStore=/opt/sdconsole/ssl/sd_keystore.pkcs12 \ -Djavax.net.ssl.keyStoreType=PKCS12 \ -Djavax.net.ssl.keyStorePassword=password \ -Xms512m -Xmx4096m -XX:+UseG1GC -XX:+UseG1GC"
The eyeInspect Passive Sensor stores certificates in different folders location depending on version:
| eyeInspect Sensor version <= 4.3.21 | /opt/nids/cert/ |
| eyeInspect Sensor version 5.0 | /opt/nids-docker/state/cert/ |
| eyeInspect Sensor integrated in the CounterAct appliance with OTSM < 2.0 | /usr/local/forescout/plugin/otsm/nids/cert |
| eyeInspect Sensor integrated in the CounterAct appliance with OTSM 2.0 | /usr/local/forescout/plugin/otsensor/nids/cert |
Those folders will include the following items:
- sensor_cert.pem: Sensor certificate signed by the same CA that signed the Command Center’s
- sensor_key.pem: the sensor certificate private key
- sensor_cc.crt: (if applicable, "chained" Root CA certificate and) Signing (Intermediate) CA certificate
The instructions assume the following items are available:
- Certificate for Command Center
- Private key for the Command Center certificate
- Certificate for Passive Sensor(s)
- Private key for the Passive Sensor(s) certificate
- Certificate of the Certification Authority (CA) which signed Command Center and Passive Sensor(s) certificates
- Access to the console of the Command Center and the Passive Sensor(s) appliances
- If the Command Center and Passive Sensors certificates have been signed by an Intermediate CA, the full chain of trust is required, e.g., both the signing Intermediate CA and the Root CA certificates
- Custom Certificates, including CA certificates and Private Key files, are already transferred to the Command Center and Passive Sensor(s) hosts
| Placeholder | Definition |
|---|---|
| signing_ca_cert.crt | Filename of the certificate of the CA which signed the Command Center certificate |
| root_ca_cert.crt | Filename of the certificate of the Root CA (if the Command Center certificate was signed by an Intermediate CA) |
| command center fqdn/san name | The fully qualified domain name as used in DNS and URLs (Subject Name or Subject Alternative Name is part of the certificate) |
| cc_cert.pem | Filename of the certificate for Command Center |
| cc_key.pem | Filename of the private key for the Command Center certificate |
| sensor_ certificate filename | Filename of the certificate for Passive Sensor(s) |
| sensor key filename | Filename of the private key for the Passive Sensor(s) certificate |