Coyote Point Systems E350GX, Installation And Administration Manual

Page: 289 / 344

Installing Certificates for an HTTPS Cluster
Equalizer Installation and Administration Guide 285
receive establish a chain of trust that ends at a trusted root certificate installed on your web server (and on every
client that interacts with the web server).
If all of your clients use the same certificate to authenticate to the server, load the entire chain onto Equalizer. If each
client uses a unique certificate, you can instead load all the intermediate and root certificates (minus the unique
client certificate) onto Equalizer, and any client certificate presented that uses that chain will be accepted.
You must install all the certificates you receive on Equalizer to complete the installation process for HTTPS clusters.
To install them on Equalizer, certificates must be in a single file, in either PEM (
.pem ) or PKCS12 ( .pfx ) format; see
the section “Preparing a Signed CA Certificate for Installation” on page 283.
To install a certificate for an Equalizer cluster, follow these steps:
1. Copy the file containing the certificate and private key information ( clustercert.pem in the examples above;
clustercert.pfx if you used IIS) to the machine from which you will log into the Equalizer Administrative
Interface. Note the location.
2. Log into the Administrative Interface using a login that has
add/del
access on the cluster that requires the
certificate (see “Logging In” on page 52).
3. In the left frame, click the name of the HTTPS or SSL cluster for which you want to install a certificate and
select the
Security > Certificates
tab in the right frame:
Figure 65 The cluster Certificates tab
Note:
If your Equalizer has
Xcel I
Hardware SSL Acceleration installed, a check box labeled
use secure key
storage
will appear at the top of the
select client or cluster certificate
field. Checking this box tells Equalizer
to store the private key for the server/cluster certificate in write-only memory on the Xcel hardware so that no
one can access it. By default, this check box disabled and Equzalizer stores the private key in its file system,
under
/var/eq/ssl . See the section “Private Key Storage for Cluster Certificates” on page 288, for more
information. This option does not appear if your Equalizer is equipped with
Xcel II
, or does not have Xcel; in
these cases, private keys are stored in Equalizer’s file system, under /var/eq/ssl .
Caution – The private key for your server certificate is kept on Equalizer (in the directory /var/eq/ssl ) and will be
accessible to anyone who can log into Equalizer. It is therefore essential that you restrict the ability of non-
authorized personnel to access Equalizer, since any user can log in and copy or remove your private key. All
Equalizer logins should be password protected with non-trivial passwords to restrict access to your private keys,
and passwords should be given only to trusted personnel. Note that the private key for a
client certificate (if used)
is not stored on Equalizer, only the client certificate.