Page History

...

Info
By default, on PrivateServer it's installed one "*.madama.at" wildcard certificate as shown in Xref AnchorName default_certificate

Subtitle
Prefix fig.figure SubtitleText The tabs to access the two section related with the certificate management AnchorName tls tabs

From this page you can decide to view and delete your keypairs or the Certification Authority entries, using the tabs shown in the above 

Xref
AnchorName tls tabs

.

Subtitle
Prefix figfigure SubtitleText link for creating new key and CSR or add new CAs AnchorName new_tls_new_ca

Instead if you need to create a new TLS key pair or add a new CA, then you have to use the buttons above the "TLS Keypair" list (the ones shown in 

Xref
AnchorName new_tls_new_ca

).

2.3.2 Create New Certificate

Add a new Certificate is a delicate matter, because it involves sensible informations like private Key

...

If you need to upload a new certificate, click on the New TlsKeyPair Management and concealing. Adding a New Certificate on PrivateServer means that you can create your own Certificate Signing Request directly on PrivateServer and no need for external Private Key creation/management tools. Of course you need to have your CSR signed by a known Certificate Authority before you can actually use it.

Certificate Creation is thus split in two steps:

1. New Key and CSR creation (before CA sign)
2. New Certificate upload (after CA sign)

New Key and CSR

So first of all you start by creating a CSR: click on the New Key and CSR link above the certificate table.

Subtitle
Prefix figure SubtitleText New certificate form AnchorName new_certificate
Image Removed Image Added

 

You are redirected on the Create TlsKeyPair page (it's on page shown in 

Xref
AnchorName new_certificate

) where an upload form needs to be filled. Its fields are:

• Description: a generic name you choose to identify this certificate
• Private Key: your private key, provided by the signature authority
• Certificate: the certificate itself
• Cert Chain: a possible intermediate certificate used to link the certification authority to your certificate.

. Here you can fill the form with all basics data needed to create a Certificate Signing Request. 

Info
All the fields in above form are standard ones for creating new TLS Key pairs/Certificate Signing Requests.

Subtitle
Prefix figure SubtitleText example values for new CSR AnchorName CSR_creation_example
Image Added

Once you're done you can just press Generate button at the bottom of the form.

Subtitle
Prefix figure SubtitleText new CSR created and listed AnchorName new_CSR_created
Image Added

A warning confirming creation and a new row in TLS Keypair list shows generation process has been successful. 

Tip
Using this Certificate creation process you don't have to deal directly with Private Keys.

Now you can download your CSR to make a Certificate Authority sign it, creating a brand new Server Certificate. 

Subtitle
Prefix figure SubtitleText Edit CSR form AnchorName Edit CSR
Image Added

Just click on Certificate's name in main list and you get form shown in 

Xref
AnchorName Edit CSR

. From here you can fully manage your CSR, upgrading it to a proper Certificate or modifying its description.

Subtitle
Prefix figure SubtitleText CSR management links AnchorName Edit_CSR_links
Image Added

Anyway you need to Download CSR before you're done with Certificate creation, so use first link shown in detailed view 

Xref
AnchorName Edit_CSR_links

.

New Certificate upload

Once you have your CSR you just follow instructions by CA of your choice to obtain a new Certificate. As it's done, you can get back to form in 

Xref
AnchorName Edit CSR

 and this time Upload certificate.

Subtitle
Prefix figure SubtitleText Upload Certificate form AnchorName upload_certificate
Image Added

You can fill Certificate text box with actual Certificate as it has been release from Certificate Authority. If you got also some intermediate Certificate, then you have to paste it in Cert Chain. 

Warning
All the fields must be in PEM (Privacy Enhanced Mail)

...

format.

When your ' done you just press the Create button Upload button on the bottom line: PrivateServer will validate entire Certificate Chain and the certificates are ready to be assigned to an interface/IPif it went thought it then you should have a new line in you TLS/Keypair. 

Subtitle
Prefix figure SubtitleText Details of the new Certificate AnchorName new_cert_details
Image Added

If you click on Certificate's Id then you can read Certificate's details as shown in 

Xref
AnchorName new_cert_details

.

Subtitle
Prefix figure SubtitleText Edit new Certificate AnchorName new_cert_detail
Image Added

You can notice that now you can also Download both Certificate and Certificate chain. Upload certificate can come handy in case of renewal.

Warning
Even if it's possible to extend Certificates validity period, PrivateWave Italia SpA strongly discourage such behaviour and suggests customers to create a fresh new CSR each time instead. We also think it is wise to keep validity period of each Certificate just one year long.

Anchor
2.3.3_add_certification_authority 2.3.3_add_certification_authority

2.3.3 Add Certification Authority

You might need to upload a new CA (Certification Authority) if you tried to install a tis key pair not Certificate which wasn't signed by an installed CA. 

Info
By default PrivateServer contains a default list of pre-loaded Certification Authorities.

Subtitle
Prefix figfigure SubtitleText the default CA list AnchorName clean_CA_list

The new CA installation becomes mandatory because without a complete certificate chain the new TLS key pair would not be accepted by PrivateServer. If you need to upload a new certificate, click on the Add certification authority button above the certificate list table.

Subtitle
Prefix figfigure SubtitleText New Certification Authority AnchorName new_CA

You get the form shown in 

Xref
AnchorName new_CA

 which is pretty straightforward. You just have to cut 'n' paste the CA's content in the Certificate box and click on the Create button at the bottom. 

Subtitle
Prefix figfigure SubtitleText CA list updated AnchorName CA_list_updated

...

In a day-by-day secure VoIP service administration it's not unusual to delete a TLS key pair. The procedure starts right at the Certificate Management page (the one shown in 

Xref
AnchorName default_certificate

.

Subtitle
Prefix figfigure SubtitleText the TLS key pair list with a testing entry to be deleted AnchorName tls_key_pair_to_delete

...

Image Removed

Warning
Please make sure no services got association with the TLS entry you're going to remove, or else the deletion would fail.
Subtitle
Prefix fig SubtitleText TLS key pair details AnchorName tls_details

 

First you click on the chosen entry and get a detail of the TLS key pair (as in 

Xref
AnchorName tlsnew_cert_details

). At the page's bottom

Subtitle
Prefix figure SubtitleText Update and Delete buttons AnchorName cert_update_delete_buttons
Image Added

At the bottom of the form there's a one Delete button. Just press it.

Subtitle
Prefix figfigure SubtitleText the deletion is confirmed AnchorName tls_key_pair_deleted

...

You cannot edit an entry in the CA list, but you still can delete a CA and create a new one for replacement. That said, the way for deleting a CA entry is quite simple. From the CA list shown in 

Xref
AnchorName CA_list_updated

 choose the CA you want to expunge and press the Delete link in the last right column. 

Subtitle
Prefix figfigure SubtitleText CA's details AnchorName delete_CA_1

First you get a detail of the certificate you're going to delete. Just press the Delete button at the bottom and confirm your choice in the next pop up window.

Subtitle
Prefix figfigure SubtitleText The CA list updated and the warning AnchorName delete_CA_2

...