Replace Active (ICSP) Sensor Certificates

 

To replace the Active Sensor certificates, a similar process is followed as for replacing the ICSP - Command Center certificates.

Stop the Active Sensor Components

Log in to the Active Sensor host using SSH. 

$ ssh silentdefense@<SENSOR_IP_ADDRESS>

Next, stop the Active Sensor components as per your version:

For Active Sensor version 1.5.x, docker-compose is used: 

$ cd /opt/icsp/icsp-sensor/
$ sudo ./docker-compose kill

For Active Sensor v2.0.x, the manage-containers.sh script is used: 

$ cd /opt/icsp/icsp-sensor/
$ sudo ./manage-containers.sh --rm

For Active Sensor v2.1.x and later, the updated Debian package name and installation path are as follows: 

$ cd /opt/active-sensor/
$ sudo ./manage-containers.sh --rm

Place the Custom Certificates

The customer specific certificates can be placed in the certificates folder ( /opt/icsp/icsp-sensor/certs or /opt/active-sensor/certs, depending on your Active Sensor version):

For Active Sensor v2.1.x and later: 

$ sudo cp /home/silentdefense/custom_ca.crt /opt/active-sensor/certs
$ sudo cp /home/silentdefense/custom_cert.pem /opt/active-sensor/certs
$ sudo cp /home/silentdefense/custom_key.pem /opt/active-sensor/certs

For Active Sensor v2.0.x and earlier: 

$ sudo cp /home/silentdefense/custom_ca.crt /opt/icsp/icsp-sensor/certs
$ sudo cp /home/silentdefense/custom_cert.pem /opt/icsp/icsp-sensor/certs
$ sudo cp /home/silentdefense/custom_key.pem /opt/icsp/icsp-sensor/certs

Note: The locations and names of the certificates used in the above commands can be tailored to the target environment.

Update the Configuration

To have the Active Sensor components pick up the newly placed certificates, the configuration needs to be updated as follows:

For Active Sensor version 1.5.x, update the settings.py file: 

$ sudo nano /opt/icsp/icsp-sensor/icsp-modules/settings.py

For Active Sensor version 2.0.x, update the .env file: 

$ sudo nano /opt/icsp/icsp-sensor/.env

For Active Sensor version 2.1.x and later, the updated installation path is: 

$ sudo nano /opt/active-sensor/.env

Un-comment and replace the Custom Certificates section as shown in the below example: 

# Example certificate setting: You may not use a certificate without a password.
# This will override the default settings; please uncomment them if you want to customize.
  CA_FILE="certs/icsp_ca.crt"
  CERT_FILE="certs/icsp_cert.pem"
  KEY_FILE="certs/icsp_key.pem"
  KEY_PASSPHRASE="yourpass"

Start the Active Sensor Components

With the certificates replaced and the settings.py file updated, start the Active Sensor components:

For Active Sensor version 1.5.x, docker-compose is used: 

$ cd /opt/icsp/icsp-sensor/
$ sudo ./docker-compose up -d

For Active Sensor v2.0.x, the manage-containers.sh script is used: 

$ cd /opt/icsp/icsp-sensor/
$ sudo ./manage-containers.sh --up

For Active Sensor v2.1.x and later, the updated installation path is as follows: 

$ cd /opt/active-sensor/
$ sudo ./manage-containers.sh --up