Replace the Active Sensor Certificates with Customer-Specific Certificates

Prerequisites

  • The certificates on the Command Center are already replaced with customer-specific certificates
  • The Certificate(s) and Key(s) to be used by Active Sensor have been generated and signed by the new CA.

In this guide, the following names are used for the customer specific certificate/key, and it is assumed that these files are already copied to the Command Center host and Sensor host:

  • custom_ca.crt (new CA certificate)
  • custom_cert.pem (new Active Sensor certificate)
  • custom_key.pem (new Active Sensor certificate key)

Support for Encrypted Files Only

Currently, only encrypted key files are supported. To check if this is the case, run the following command:

$ head -1 custom_key.pem

The expected output is as follows:

-----BEGIN ENCRYPTED PRIVATE KEY-----

If the output is as follows,

-----BEGIN [RSA] PRIVATE KEY-----
execute the following command to obtain an encrypted copy of the file:
$ openssl rsa -aes256 -in custom_key.pem -passout pass:password -out custom_enc_key.pem

Then, make a backup of the custom_key.pem file and rename custom_enc_key.pem to custom_key.pem.

Procedure

To replace the active sensor certificates with customer-specific ones, the following steps should be performed, in order:

  1. Replace ICSP - Command Center certificates (not necessary from ICSP-CC version 2.1.0 (Command Center v5.7.0) and later.)
  2. Replace Active Sensor certificates
  3. Reset API key