About HTTPS Certificates

The NIOS appliance generates a self-signed certificate when it first starts. A self-signed certificate is signed by the subject of the certificate, and not by a CA (Certificate Authority). This is the default certificate. When your computer first connects to the NIOS appliance, it sends this certificate to authenticate itself to your browser.
Because the default certificate is self-signed, your browser does not have a trusted CA certificate or a cached NIOS appliance server certificate (saved from an earlier connection) to authenticate the NIOS appliance certificate. Also, the hostname in the default certificate is www.infoblox.com, which is unlikely to match the hostname of your NIOS appliance. Consequently, messages appear warning that the certificate is not from a trusted certifying authority and that the hostname on the certificate is either invalid or does not match the name of the site that sent the certificate. Either accept the certificate just for this session or save it to the certificate store of your browser.
To eliminate certificate warnings, you can replace the default self-signed certificate with a different certificate that has the hostname of your NIOS appliance. The NIOS appliance supports X.509 certificates in .PEM format. After the initial login, you can do one of the following:

- Generate another self-signed certificate with the correct hostname and save it to the certificate store of your browser.
- Request a CA-signed certificate with the correct hostname and load it on the NIOS appliance.
- When you receive the certificate from the CA, import it to the appliance.
- Download the certificate from a trusted CA.

Generating Self-Signed Certificates

You can replace the default certificate with a self-signed certificate that you generate. When you generate a
self-signed certificate, you can specify the correct hostname and change the public/private key size, enter valid dates and specify additional information specific to the NIOS appliance. If you have multiple appliances, you can generate a certificate for each appliance with the appropriate hostname. You can generate a self-signed certificate using either the SHA-1 or SHA-256 (SHA-2) hash algorithm.
To generate a self-signed certificate:

Grid: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box, and then click Certificates -> HTTPS Cert -> Generate Self-signed Certificate from the Toolbar. In a Grid, ensure that you select the Grid Master when generating a self-signed certificate.
In the Generate Self-Signed Certificate dialog box, complete the following:
- Secure Hash Algorithm and Key Size: You can select SHA-1 and a RSA key size of 1024 or 2048. SHA-256 (SHA-2) can be selected together with a RSA key size of 2048 or 4096. The default value is SHA-256 2048.
  NOTE: If your Grid includes a reporting server, ensure that you DO NOT select a key size of 4096 bit for SHA-256. Otherwise, the reporting feature might not function properly because Java does not support SHA-256 with a 4096 key size.
- Days Valid: Specify the validity period of the certificate.
- Common Name: Specify the domain name of the NIOS appliance. You can enter the FQDN (fully qualified domain name) of the appliance.
- Organization: Enter the name of your company.
- Organizational Unit: Enter the name of your department.
- Locality: Enter a location, such as the city or town of your company.
- State or Province: Enter the state or province.
- Country Code: Enter the two-letter code that identifies the country, such as US.
- Admin E-mail Address: Enter the email address of the appliance administrator.
- Comment: Enter information about the certificate.
Click OK.
If the appliance already has an existing HTTPS certificate, the new certificate replaces the existing one. In the Replace HTTPS Certificate Confirmation dialog box, click Yes. The appliance logs you out, or you can manually log out. When you log in to the appliance again, it uses the new certificate you generated.

Generating Certificate Signing Requests

You can generate a CSR (certificate signing request) that you can use to obtain a signed certificate from your own trusted CA. Once you receive the signed certificate, you can import it in to the NIOS appliance. To generate a CSR:

Grid: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box, and then click Certificates -> HTTPS Cert -> Create Signing Request from the Toolbar.
In the Create Certificate Signing Request dialog box, enter the following:
- Secure Hash Algorithm and Key Size: You can select SHA-1 and a RSA key size of 1024 or 2048. SHA-256 (SHA-2) can be selected together with a RSA key size of 2048 or 4096. The default value is SHA-256 2048.
- Common Name: Specify the domain name of the NIOS appliance. You can enter the FQDN of the appliance.
- Organization: Enter the name of your company.
- Organizational Unit: Enter the name of your department.
- Locality: Enter a location, such as the city or town of your company.
- State or Province: Enter the state or province.
- Country Code: Enter the two-letter code that identifies the country, such as US.
- Admin E-mail Address: Enter the email address of the appliance administrator.
- Comment: Enter information about the certificate.
Click OK.

Uploading Certificates

When you receive the certificate from the CA, and import it to the appliance, the NIOS appliance finds the matching CSR and takes the private key associated with the CSR and associates it with the newly imported certificate. The appliance then automatically deletes the CSR.
If the CA sends an intermediate certificate that must be installed along with the server certificate, you can upload both certificates to the appliance. The appliance supports the use of intermediate certificates to complete the chain of trust from the server certificate to a trusted root CA. This eliminates intermediate certificate security warnings that appear when you open a web browser and try to connect to an Infoblox appliance.
To import a certificate:

Grid: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box, and then click Certificates -> HTTPS Cert -> Upload Certificate from the Toolbar.
Navigate to where the certificate is located and click Open.
If the appliance already has an existing HTTPS certificate, the new certificate replaces the existing one. In the Replace HTTPS Certificate Confirmation dialog box, click Yes.

The appliance imports the certificate and logs you out. When you log in to the appliance again, it uses the certificate you imported.

Downloading Certificates

You can download the current certificate or a self-signed certificate. To download a certificate:

Grid: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box, and then click Certificates -> HTTPS Cert -> Download Certificate from the Toolbar.
Navigate to where you want to save the certificate, enter the file name, and then click Save.

About Client Certificates

You can generate client certificates for a Grid Master or a Grid Master candidate, and then send it to another server, such as a Hardware Security Module (HSM).

Generating a Client Certificate

To generate a client certificate:

Grid: From the Grid tab, select the GridManager tab.
Grid Master Candidate: From the Grid tab, select the GridManager tab -> Members tab -> member check box.
From the Toolbar, click Certificates -> ClientCert -> GenerateClientCertificate, and select either RSASHA1 or RSASHA256.

If you are generating a certificate for an HSM group with SafeNet Luna SA 4 devices, you must select RSASHA1; and if the certificate is for an HSM group with SafeNet Luna SA 5 or Luna SA 6 devices, select RSASHA256.

The appliance displays a confirmation dialog after it generates the certificate. If a certificate had been previously generated, the appliance displays a dialog warning that if the previous certificate was registered with a server, then the new certificate must be registered with the server.

Viewing Client Certificates

To view the client certificates that were generated:

Grid: From the Grid tab, select the Grid Manager tab.
Grid Master Candidate: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box.
From the Toolbar, click Certificates -> Client Cert -> View Client Certificate, and select either RSASHA1 or RSASHA256.

The appliance displays the selected certificate.

Downloading Client Certificates

To download a client certificate:

Grid: From the Grid tab, select the Grid Manager tab.
Grid Master Candidate: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box.
From the Toolbar, click Certificates -> Client Cert -> Download Client Certificate, and select either RSASHA1 or RSASHA256.
Save the certificate.

About CA Certificates

If the CA sends an intermediate certificate that must be installed along with the server certificate, you can upload both certificates to the appliance. The appliance supports the use of intermediate certificates to complete the chain of trust from the server certificate to a trusted root CA. This eliminates intermediate certificate security warnings that appear when you open a web browser and try to connect to an Infoblox appliance.
When you configure two-factor authentication for smart card users, ensure that you upload the required CA certificates before you enable the certificate authentication service. For information about two factor authentication and how to configure it, see Defining the Authentication Policy. Only superusers and limited-access users with the required permissions can manage CA certificates. For information about admin permissions, see Administrative Permissions for Certificate Authentication Services and CA Certificates.

Uploading CA Certificates

To upload a CA-signed certificate:

Grid: From the Grid tab, select the Grid Manager tab.
Member: From the Grid tab, select the Grid Manager tab -> Members tab -> member check box.
Select Certificates -> Manage CA Certificates from the Toolbar.
In the CA Certificates editor, click the Add icon.
In the Upload dialog box, click Select and navigate to the certificate you want to upload.
Select the file and click Upload.

Note: NIOS can only upload certificates that are in PEM format. A.PEM file can contain more than one certificate.

Repeat the steps to add additional CA-signed certificates.
The CA Certificates dialog box displays the following information about the intermediate certificates:

Subject: The name of the certificate.
Issuer: The name of the trusted CA that issued the certificate.
Serial: The serial number of the certificate.
Valid: The validity period of the certificate.
Usedby: Displays SSL/TLS, when CA certificate is not used for certificate authentication, or CAS, when CA certificate is associated with a certificate authentication service.

You can also do the following:

Select a certificate and click the Delete icon to delete it.
Print the data or export it in .csv format.

Converting CA Certificates to PEM Format

NIOS can only upload certificates that are in PEM format. PEM files are Base64 encoded ASCII files. You can use OpenSSL to convert other certificate formats, such as P7B and DER, into PEM format.
You can run OpenSSL on Linux and Windows systems. For Linux, OpenSSL is pre-installed. For Windows, you can manually install an OpenSSL for Windows. For information about OpenSSL, visit its web site at http://www.openssl.org/.
To convert a P7B file to PEM format using OpenSSL:

Download and unzip the CA certificate file in P7B format.
Navigate to the directory where you unzip the CA certificate file.
Identify the PKCS7 directory.
Use the following OpenSSL command to convert the P7B file to PEM format:
$ openssl pkcs7 -in xxxx.p7b -print_certs -out yyyy.pem
where xxxx is the name of the P7B file and yyyy is the name of the converted PEM file.

To convert a DER file to PEM format using OpenSSL:

Download and unzip the CA certificate file in DER format.
Navigate to the directory where you unzip the CA certificate file.
Use the following OpenSSL command to convert the DER file to PEM format:
$ openssl x509 -inform DER -outform PEM -in xxxx.cer -out yyyy.pem
where xxxx is the name of the DER file and yyyy is the name of the converted PEM file.