3
rd
Generation Rack-
Mount RDMS™
102
Quasonix, Inc.
Web Server Differences with CS1 Option
With the CS1 Cybersecurity option, two items are added to the Web Server screen: User Certificate and HSTS.
When User Certificate is turned On, the RDMS web server utilizes an HTTPS Certificate provided by the user
instead of a certificate generated internally by the RDMS. A User Certificate provides the user more control over the
creation and signing of the certificate, which may be required in some installations. The HSTS setting stands for
HTTP Strict Transport Security and is a web security policy that allows the RDMS web server to declare that web
browsers should connect to it using only HTTPS connections.
4.4.2.27.3.1.1 User Certificate
In order to use a user-provided certificate, the following general steps must be performed:
1. Create directory structure for use with OpenSSL
2. (Optionally) Create a Certificate Authority and Key
3. Create a server certificate and private key that will be utilized by the RDMS web server.
4. Present the server certificate to your signing authority to have it signed.
5. Upload the certificate and
private key to the RDMS via the ‘admin’ user account.
6. Enable the User Certificate setting on the Web Server screen.
7. Upload your Certificate Authority certificate to your web browser.
In these instructions, Quasonix recommends the use of OpenSSL v1.1.1d or newer. Other tools and methods are
available to create certificates and keys, but only OpenSSL is officially supported to work with this User Certificate
feature. Additionally, keep in mind that this is merely one configuration that will work. OpenSSL is a complex tool
with many configurations and capabilities.
4.4.2.27.3.1.1.1 Create Directory Structure
In order to use OpenSSL for key and certificate creation, a directory structure must be set up. Create a main
directory to use with OpenSSL (the example below uses rdms_server_cert), and create the following subdirectories:
certs, crl, csr, newcerts, and private. In the main directory, create an empty file named index.txt and a file named
serial with contents ‘1000’. Finally, create a file called openssl.cnf with the f
ollowing contents. Some entries need to
be changed to reflect your setup and are highlighted in the file listing.
# OpenSSL root CA configuration file.
[ ca ]
# `man ca`
default_ca = CA_default
[ CA_default ]
# Directory and file locations.
Dir = /home/jm/rdms_cert_inst
certs = $dir/certs
crl_dir = $dir/crl
new_certs_dir = $dir/newcerts
database = $dir/index.txt
serial = $dir/serial
RANDFILE = $dir/private/.rand
# The root key and root certificate.
Private_key = $dir/private/ca.key.pem
certificate = $dir/certs/ca.cert.pem
# For certificate revocation lists.
