Federation Manager Guide › Migrate Federation Manager to Use FIPS Encryption › How To Migrate from FIPS_COMPAT Mode to FIPS-Only Mode › Obtain FIPS-Compatible SSL Certificates (Optional) › Upload the FIPS-Compatible Certificate

Upload the FIPS-Compatible Certificate

After you acquire a new certificate, upload it to the key store. If you requested more than one certificate, upload each one separately.

To upload a new certificate

1. Navigate to Infrastructure, SSL Configuration.

   The SSL Configuration dialog displays.

2. Click Browse next to the Signed Certificate Response field to locate the new signed response file.

   Note: You only need one key and certificate pair for the SSL features because SSL does not support more than one pair.

3. Select the CA that signed the SSL certificate from the pull-down menu in the CA Certificate field.

   If the CA certificate is not in the key store, import a copy of the CA certificate used to sign the SSL certificate request.

4. Click Import to import the certificate and complete the import steps.
5. Click Apply to upload the server certificate to Federation Manager.

   A confirmation message is displayed and the SSL Configuration changes to reflect that the certificate is now updated.

6. Click Activate and restart the SSL configuration.

   The FIPS Approved status must read True, indicating the certificate is FIPS-compatible.

7. Restart the Federation Manager services, according to your operating environment.
   • Windows

     Use the Federation Manager stop and start shortcuts as follows:

     1. Start, All Programs, CA, FederationManager, Stop services
     2. Start, All Programs, CA, FederationManager, Start services
   • Solaris

     a. Open a command window.

     b. Run the following scripts:

     federation_mgr_home/fedmanager.sh stop

     federation_mgr_home/fedmanager.sh start

     When you run the fedmanager.sh script, it sources the Federation Manager environment script, ca_federation_env.ksh.

     Note: Do not stop and start the services as the root user. You must be a non-root user.

The server certificates for SSL configuration are now FIPS-compatible.