Replace ICSP - Command Center Certificates

 

Note: This step is no longer required from ICSP-CC version 2.1.0 (Command Center v5.7.0) and later.

Stop the ICSP-CC Components

Log in to the Command Center host using SSH: 

$ ssh silentdefense@<CC_IP_ADDRESS>

To replace the certificates used by the ICSP-CC components, the components have to be stopped first. This requires the manage-containers.sh script in the ICSP-CC installation directory to be executable.

To make the script executable, run the following command:

$ cd /opt/icsp/icsp-cc/
$ sudo chmod +x manage-containers.sh

To stop the ISCP-CC components, run the following commands:

$ cd /opt/icsp/icsp-cc/
$ sudo ./manage-containers.sh --rm

Place the Custom Certificates

The customer-specific certificates can be placed in the certificates folder (/opt/icsp/icsp-cc/certs):

$ sudo cp /home/silentdefense/custom_ca.crt /opt/icsp/icsp-cc/certs
$ sudo cp /home/silentdefense/custom_cert.pem /opt/icsp/icsp-cc/certs
$ sudo cp /home/silentdefense/custom_key.pem /opt/icsp/icsp-cc/certs

Note: The locations and names of the certificates used in the above commands can be tailored to the target environment.
Note: When also using high availability, make sure that the files have permissions that allow them to be synced between Command Centers (-rw-r--r--):
chmod 644 /opt/icsp/icsp-cc/certs/custom_ca.crt 
chmod 644 /opt/icsp/icsp-cc/certs/custom_cert.pem  
chmod 644 /opt/icsp/icsp-cc/certs/custom_key.pem

Update the Configuration

To have the ICSP-CC components pick up the newly placed certificates, the configuration needs to be updated as follows:

For ICSP-CC version 1.5.x, update the settings.py file: 

$ sudo nano /opt/icsp/icsp-cc/icsp-core/settings.py

For ICSP-CC version 2.0.x, update the .env file: 

$ sudo nano /opt/icsp/icsp-cc/.env

Un-comment and replace the Custom Certificates section, as shown in the below example:

# Example certificate setting: You may not use a certificate without a password.
# This will override the default settings; please uncomment them if you want to customize.
CA_FILE="certs/icsp_ca.crt"
CERT_FILE="certs/icsp_cert.pem"
KEY_FILE="certs/icsp_key.pem"
KEY_PASSPHRASE="yourpass"

Start the ICSP-CC Components

With the certificates replaced and the settings.py file updated, start the ICSP-CC components and remove executable permissions for manage-containers.sh script:

$ cd /opt/icsp/icsp-cc/
$ sudo ./manage-containers.sh --up