Policy Server Guides › Policy Server Configuration Guide › Troubleshooting SSL Authentication Schemes › SSL Configuration

SSL Configuration

Configure SSL and verify that it works properly before using the product. In order to make an SSL connection, you must be able to trust the certificate authority of an incoming certificate. For example, if a browser presents a certificate that is signed by VeriSign, you must have a VeriSign Certificate Authority that is installed and trusted in the web server. In addition to trusting client certificates that are presented, the server itself must have a certificate to present to the clients. The clients have to trust the Certificate Authority that issued the certificate. This setting allows mutual authentication. Once these certificates have been installed, you can configure the Web Server to use SSL and require certificates, if desired.

For detailed SSL configuration information, see the documentation that is provided with your web server software. This section contains step-by-step instructions for configuring your web server and browser to establish an SSL connection.

Enable the Web Server to Trust Client Certificates in Netscape

If a certificate authority is already installed in the Web Server, go on to the next section. Otherwise, install a certificate for the Certificate Authority on the SSL Web Server.

Follow these steps:

1. Obtain the Certificate Authority certificate and either keep it on your screen or save it to a file.
2. In Netscape Server Administration, select Keys & Certificates.
3. Click Install Certificate.
4. In the Certificate For field, fill out the Server Security Chain.
5. In the Certificate Name field, enter a description.
6. If you saved your Certificate Authority certificate to a file, enter the file name in the Message is in this file field. Otherwise, select the Message text (with headers) option button and paste the certificate in the Message text (with headers) field.
7. Click OK and restart the Web Server.

Configure the Netscape Web Server to use SSL

Configure the Netscape Web Server for SSL by requiring certificates.

Follow these steps:

1. In Netscape Server Administration, click Admin Preferences.
2. Click Encryption On/Off and ensure that Encryption is on.
3. If you are running the Certificate or Certificate with Basic Authentication Scheme, require certificates. See the Encryption Preferences setting where Require Certificates must be set to On. From a browser with an installed certificate, verify that you can get to https://servername:port.

Note: Do not turn on Required Certificates for the Certificate or Basic Authentication Scheme.

Establish Trust for the Netscape Certificate Authority

If a certificate authority is installed in the Web Server, you can establish trust between the two.

Follow these steps:

1. In Netscape Server Administration, select Keys & Certificates.
2. Select Manage Certificates.
3. Select the Certificate Authority. The system displays a dialog detailing the certificate.
4. Select Trust.
5. Click OK and restart the Web Server.

Enable the Web Server to Trust Client Certificates in Windows

Trust your client certificates by installing the appropriate Certificate Authority Certificates.

SSL Web Servers must have certificates for each Certificate Authority. Major certificate authorities could possibly have been installed. You can configure certificates in Windows operating environments by using the Certificates snap-in.

Configure the IIS Web Server to use SSL

Be sure that a secure port has been enabled on the Web Server. Generally this is port 443. You can verify this through the Management Console by right-clicking on the Web Server and in the Web site tab you will see an SSL Port. Be sure a port number has been installed.

The advanced authentication schemes will create virtual directories in the Web Server. These directories will automatically be configured to require SSL and certificates as required by the specific authentication scheme. However, for testing purpose, you may want to create a test virtual directory. You can configure this virtual directory to require certificates through the Directory Security tab, Secure Communications.

https://servername:port/virtual directory - Ensure that the browser is asked for a certificate.

Install the IIS Web Server Certificate

If you have not already done so, you will need to generate a key for your Web server. This is done through the Management Console, Key Manager. Access the Key Manager by doing the following:

Note: Note this process may be slightly different for IIS 3 and IIS 4.

To install the IIS Web Server Certificate

1. In the Management Console, right-click the Web Server and select Properties.
2. Click the Directory Security tab.
3. In the Secure Communications panel, click Key Manager.
4. Under Key, select Create New Key and a Wizard will guide you through the process.

   Once you create a key, you can request a certificate using the file created in the steps mentioned earlier. Go to the Certificate Authority and request a certificate for this server. You will need to paste the certificate request information generated in Step 1 in order to receive a certificate. Once you received a certificate, go back to Management Console, Directory Security and click Key Manager to install the certificate for the key described in the next step.

5. Right-click the key name and select Install Certificate.
6. Restart the Web Server.

Enable the Web Server to Trust Client Certificates in Apache

If a certificate authority is already installed on your web server, go on to the next section. Otherwise, install a certificate for the Certificate Authority on the SSL web server as follows.

Follow these steps:

1. Download and build the following Apache components:
   • Apache
   • OpenSSL
   • Mod_SSL
   • Mod_so - This module is included as part of Apache, but it must be enabled during the build of the web server.
   • RSAref-2.0
2. Copy the Certificate Authority certificate into the apache/conf/ssl.crt directory in x509 b64 format.
3. Run make in the apache/conf/ssl.crt directory.
4. Restart the web server.

Installing the Apache Web Server Certificate

The process for installing a certificate on an Apache Web Server varies with individual configurations. Consult the documentation for Mod_SSL and OpenSSL for details about how to configure these components.