Replace the Certificates

Connect to the terminal of the Command Center appliance using SSH and create a folder for the new custom certificate files:

signing_ca_cert.crt
root_ca_cert.crt (if the Command Center certificate was signed by an Intermediate CA)
cc_cert.pem
cc_key.pem

$ mkdir -p /home/silentdefense/custom-certs

Create a PKCS12 container with name pkcs12-keystore-import.pfx including:

certificate for Command Center
private key for the Command Center certificate
certificate of the CA which signed Command Center and Passive Sensor(s)

$ openssl pkcs12 -export -in cc_cert.pem \
-inkey cc_key.pem \
-out pkcs12-keystore-import.pfx \
-password pass:password \
-certfile signing_ca_cert.crt \
-name <command center fqdn/san name>

Generate a java keystore with name sd_keystore.pkcs12 and import the Signing CA certificate:

$ keytool -import -trustcacerts -file signing_ca_cert.crt \
-keystore sd_keystore.pkcs12 -noprompt \
-alias sm -storetype pkcs12 \
-storepass password

If the Command Center certificate has been signed by an Intermediate CA certificate, import the Root CA certificate as well:

$ keytool -import -trustcacerts -file root_ca_cert.crt \
-keystore sd_keystore.pkcs12 -noprompt \
-alias root_ca -storetype pkcs12 \
-storepass password

Import the PKCS12 container into the Java keystore:

$ keytool -importkeystore -srckeystore pkcs12-keystore-import.pfx \
-srcstoretype PKCS12 \
-srcstorepass password \
-destkeystore sd_keystore.pkcs12 \
-storepass password

Deploy the Java keystore:

$ sudo cp sd_keystore.pkcs12 /opt/sdconsole/ssl/sd_keystore.pkcs12

Create a backup copy the Java keystore:

$ sudo cp /opt/sdconsole/ssl/sd_keystore.pkcs12 /opt/sdconsole/ssl/sd_keystore.pkcs12.FS

Restart the affected services; holding on until Passive Sensor(s) certificates are also deployed can minimize the time during which sensors cannot communicate with the Command Center; especially in case custom certificates must be deployed on several sensors, waiting for them to also be ready for services restart is recommended.

$ sudo supervisorctl restart all

Verify the status of all services to be “RUNNING” (some will appear “STARTING” the first seconds after a restart):

$ sudo supervisorctl status

In case of unexpected system state, the change can easily be reverted by executing:

$ sudo cp /opt/sdconsole/ssl/sd_keystore.pkcs12.FS \ /opt/sdconsole/ssl/sd_keystore.pkcs12
$ sudo supervisorctl restart all

Access the Passive Sensor appliance with user ‘silentdefense’ and check whether the private key to the Passive Sensor(s) certificate is encrypted issuing the command:

$ head -2 <sensor key filename>

In case the output DOES NOT contain the string "ENCRYPTED ", execute the following command to obtain an encrypted copy of the file:

$ openssl rsa -aes256 -in <sensor key filename> -passout pass:password -out sensor_key.pem

In case the output DOES contain the string "ENCRYPTED", the file can just be renamed:

$ mv <sensor key filename> sensor_key.pem

Create a backup copy of the /opt/nids/cert directory. Please note the ‘cert’ folder could be located in a different location depending on the version:

$ sudo cp -Rp /opt/nids/cert /var/backups/_opt_nids_cert.FS

Copy the Passive Sensor certificate file into the default location

$ sudo cp <sensor certificate filename> /opt/nids/cert/sensor_cert.pem

Copy the Passive Sensor certificate private key file into the default location:

$ sudo cp sensor_key.pem /opt/nids/cert/sensor_key.pem

Copy the Certificate Authority certificates into the default location:

$ sudo cp <organization ca certificate filename> /opt/nids/cert/sensor_cc.crt

Note: If the Command Center and Passive Sensors certificates have been signed by an Intermediate CA, this file should contain the Root CA certificate followed by Intermediate CA certificate, both in PEM format.

If present, remove the shadow /opt/nids/cert/SecurityMatters.crt file.

Restart the supervisor service (as mentioned above, this action can easily be coordinated with the corresponding one on the Command Center host):

$ sudo supervisorctl restart nids

Verify the status of all services to be “RUNNING” (some will appear “STARTING” the first seconds after a restart):

$ sudo supervisorctl status

In case of unexpected system state, the change can easily be reverted by:

$ sudo cp /var/backups/_opt_nids_cert.FS/* /opt/nids/cert/.
$ sudo supervisorctl restart all