CA SiteMinder® Federation Standalone Installation and Upgrade Guide › Migrate CA SiteMinder® Federation Standalone to Use FIPS Encryption › How to Migrate from FIPS_COMPAT Mode to FIPS_Only Mode › Obtain FIPS-Compatible SSL Certificates (Optional) › Upload the FIPS-Compatible Certificate

Upload the FIPS-Compatible Certificate

After you acquire a new certificate, upload it to the key store. If you requested more than one certificate, upload each one separately.

To upload a new certificate

1. Navigate to Infrastructure, SSL Configuration.

   The SSL Configuration dialog displays.

2. Click Browse next to the Signed Certificate Response field to locate the new signed response file.

   Note: You only need one key and certificate pair for the SSL features because SSL does not support more than one pair.

3. Select the CA that signed the SSL certificate from the pull-down menu in the CA Certificate field.

   If the CA certificate is not in the key store, import a copy of the CA certificate used to sign the SSL certificate request.

4. Click Import to import the certificate and complete the import steps.
5. Click Apply to upload the server certificate to CA SiteMinder® Federation Standalone.

   A confirmation message is displayed and the SSL Configuration changes to reflect that the certificate is now updated.

6. Click Activate and restart the SSL configuration.

   The FIPS Approved status must read True, indicating the certificate is FIPS-compatible.

7. Restart the federation services according to your operating environment.
   • Windows

     Use the stop and start shortcuts as follows. If you logged in as a network user and not a local administrator, right-click the shortcut and select Run as administrator.

     1. Start, All Programs, CA, Federation Standalone, Stop services
     2. Start, All Programs, CA, Federation Standalone, Start services
   • UNIX

     a. Open a command window.

     b. Run the following scripts:

     federation_home/fedmanager.sh stop

     federation_home/fedmanager.sh start

     Note: Do not stop and start the services as the root user.

The server certificates for SSL configuration are now FIPS-compatible.