• Openssl Generate Private Key Csr
• Generate Private Key Based On Csr Property

Introduction

This document describes the procedure to generate certificates which have to be uploaded with every fresh installation of AMP Virtual Private Cloud (VPC). With the introduction of AMP Private Cloud 3.X, hostnames and certificate/key pairs are required for all of the following services:

Jul 09, 2019 The Private Key is generated with your Certificate Signing Request (CSR). The CSR is submitted to the Certificate Authority right after you activate your Certificate. The Private Key must be kept safe and secret on your server or device, because later you’ll need it for Certificate installation. Generate CSR You can use this CSR Generator tool for free. It will automatically generate your CSR (Certificate Signing Request) and your Private Key, based on the information which you will introduce in the CSR form below. You will need the CSR code when applying for an.

• Administration Portal
• Authentication (new in Private Cloud 3.X)
• FireAMP Console
• Disposition Server
• Disposition Server - Extended Protocol
• Disposition Update Service
• Firepower Management Center

Here, we will discuss a quick way to generate and upload the required certificates. You may tweak each of the parameters, including the hashing algorithm, key size, and others, as per your organization's policy, and your mechanism of generating these certificates might not match with what is detailed here.

Prerequisites

Components Used

Cisco recommends that you have knowledge of these topics:

• Windows Server 2008 onwards
• AMP Private Cloud installation
• Public Key Infrastructure

Requirements

The information in this document is based on these software and hardware versions:

• Windows Server 2008
• CentOS 7
• AMP Virtual Private Cloud 3.0.2

Warning: The procedure mentioned below can vary as per your CA server configuration. It is expected that the CA server of your choice is already provisioned and the configuration of the same has been completed. The following technote just describes an example of generating the certificates and Cisco TAC will not be involved in troubleshooting issues related to certificate generation and/or CA server issues of any kind.

Generate Certificates on Window Server

Ensure that the following roles are installed and configured on your Windows Server.

• Active Directory Certificate Services
• Certification Authority
• Certification Authority Web Enrollment
• Online Responder
• Certificate Enrollment Web Service
• Certificate Enrollment Policy Web Service
• Active Directory Domain Services
• DNS Servers
• Web Server (IIS)

Generate a Certificate Signing Request (CSR)

Step 1. Navigate to MMC console, and add the Certificates snap-in for your computer account as shown in the image here.

Step 2. Drill down Certificates (Local Computer) > Personal > Certificates.

Step 3. Right click on the empty space and select All Tasks > Advanced Operations > Create Custom Request

Step 4. Click Next at the Enrollment window.

Step 5. Select your certificate enrollment policy and click Next.

Step 6. Choose the template as Web Server and click Next.

Step 7. If your 'Web Server' template has been configured correctly and is available for enrollment, you will see the status as 'Available' here. Click 'Details' to expand click on Properties.

Step 8. At a minimum, add the CN and DNS attributes. The rest of the attributes can be added as per your security requirements.

Step 9. Optionally, give a Friendly Name under the General tab.

Step 10. Click on the PrivateKey tab and ensure that you're enabling Make private key exportable under the Key Options section.

Step 11. Finally, click on OK. This should lead you to the Certificate Enrollment dialog from where you can click on Next.

Step 12. Browse to a location to save the .req file which will be submitted to the CA server for signing.

Submitting the CSR to the CA and generating the certificate

Step 1. Navigate to your MS AD Certificate Services Web Page as below and click 'Request a Certificate'

Step 2. Click on the advanced certificate request link.

Step 3. Click on Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

Step 4. Open the contents of the previously saved .req file (CSR) via Notepad. Copy the contents and paste it here. Ensure that the Certificate Template is selected as Web Server

Step 5. Finally, click on Submit.

Step 6. At this point, you should be able to Download the certificate as shown in the image here.

Exporting the Private Key and converting to PEM format

Step 1. Install the certificate into your Certificate Store by opening the .cer file and clicking on Install Certificate.

Step 2. Navigate to the MMC snap-in that was selected earlier.

Step 3. Navigate to the store where the certificate was installed.

Step 4. Right click the correct certificate, select All Tasks > Export.

Step 5. At the Certificate Export Wizard, confirm to export the private key as shown in the image.

Step 6. Enter a password and click Next to save the private key on your disk.

Step 7. This will save the private key in .PFX format, however, this needs to be converted to .PEM format to use this with AMP VPC.

Step 8. Install OpenSSL libraries from here:https://wiki.openssl.org/index.php/Binaries

Step 9. Open a command prompt window and change to the directory where you installed OpenSSL.

Step 10. Run the following command to extract the private key and save it to a new file: (If your PFX file is not in the same path as where the OpenSSL library is stored, you will have to specify the exact path along with the filename)

Step 11. Now run the following command to also extract the public cert and save it to a new file:

Generate Certificate on Linux Server

Ensure that the Linux server that you're trying to generate the required certificates has the OpenSSL libraries installed. Verifying if this and the procedure listed below will vary from the Linux distribution that you're running. This portion has been documented, as done on a CentOS 7 server.

Generate Self Signed RootCA

Step 1. Generate the Private Key for Root CA certificate

Step 2. Generate the CA certificate

Generate a certificate for each service

Create the certificate for Authentication, Console, Disposition, Disposition-Extended, Update server, Firepower Management Center(FMC) service as per the DNS name entry. You need to repeat below certificate generate process for each service (Authentication, Console etc.)

Generate Private key

Openssl Generate Private Key Csr

Replace the <example.key> with actual certificate key such as Auth-Cert.key.

Generate CSR

Replace the <example.csr> with actual certificate CSR such as Auth-Cert.csr

Generate Certificate

Replace <example.csr>, <example.crt> with actual certificate CSR and certificate nameWindows 8.1 key generator 2015 download.

Adding The Certificates to AMP VPC

Step 1. Once the certificates are generated from any of the above methods, upload the corresponding certificate for each of the services. If they have been generated correctly, all the check marks are enabled as seen in the image here.

Verify

There is currently no verification procedure available for this configuration.

Troubleshoot

There is currently no specific troubleshooting information available for this configuration.

The following instructions will guide you through the CSR generation process on Nginx (OpenSSL). To learn more about CSRs and the importance of your private key, reference our Overview of Certificate Signing Request article. If you already generated the CSR and received your trusted SSL certificate, reference our SSL Installation Instructions and disregard the steps below.

1. Log in to your server’s terminal.

You will want to log in via Secure Shell (SSH).

Generate Private Key Based On Csr Property

2. Enter CSR and Private Key command

Generate a private key and CSR by running the following command:

Here is the plain text version to copy and paste into your terminal:

Note:Replace “server ” with the domain name you intend to secure.

3. Enter your CSR details

Enter the following CSR details when prompted:

• Common Name: The FQDN (fully-qualified domain name) you want to secure with the certificate such as www.google.com, secure.website.org, *.domain.net, etc.
• Organization: The full legal name of your organization including the corporate identifier.
• Organization Unit (OU): Your department such as ‘Information Technology’ or ‘Website Security.’
• City or Locality: The locality or city where your organization is legally incorporated. Do not abbreviate.
• State or Province: The state or province where your organization is legally incorporated. Do not abbreviate.
• Country: The official two-letter country code (i.e. US, CH) where your organization is legally incorporated.

Note: You are not required to enter a password or passphrase. This optional field is for applying additional security to your key pair.

4. Generate the order

Locate and open the newly created CSR in a text editor such as Notepad and copy all the text including:

Note 1: Your CSR should be saved in the same user directory that you SSH into unless otherwise specified by you.

Note 2: We recommend saving or backing up your newly generate “.key ” file as this will be required later during the installation process.

Return to the Generation Form on our website and paste the entire CSR into the blank text box and continue with completing the generation process.

Upon generating your CSR, your order will enter the validation process with the issuing Certificate Authority (CA) and require the certificate requester to complete some form of validation depending on the certificate purchased. For information regarding the different levels of the validation process and how to satisfy the industry requirements, reference our validation articles.

After you complete the validation process and receive the trusted SSL Certificate from the issuing Certificate Authority (CA), proceed with the next step using our SSL Installation Instructions for Nginx using OpenSSL.