How to generate certificates for use

In order to generate a demo SSL certificate you can use the Java keytool utility or the Universal Messaging Certificate Generator utility.

The Java keytool utility can be used to create and handle certificates. Keytool stores all keys and certificates in a keystore. For a detailed description of Java's keytool please see its documentation at http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html.

The Universal Messaging Certificate Generator utility can be used to generate a self signed server certificate, a self signed client certificate and a trust store for the above two.

You can run the Certificate Generator from the Start Menu on Windows by selecting the server/<realm name>/Create Demo SSL Certificates

Alternatively you can open a server Command Prompt and run the utility as required for your platform:

This will generate 3 files:

It is also possible to customize some elements of these certificates stores such as the password, the host bound to the server CN attribute and they key size.This can be done by passing the following optional command line arguments to the Certificate Generator:

In order to obtain a real SSL Certificate, you must first generate a CSR (Certificate Signing Request). A CSR is a body of text that contains information specific to your company and domain name. This is a public key for your server.

The Java keytool utility can be used to create and handle certificates. Keytool stores all keys and certificates in a keystore. For a detailed description of keytool please see its documentation.

Use the keytool to create a keystore with a private/public keypair.

You will be prompted for information about your organisation. Please note that when it asks for "User first and last name", please specify the hostname that Universal Messaging will be running on ( e.g. www.yoursite.com ).

Use the keytool to create a certificate request.

This will generate a file containing a certificate request in text format. The request itself will look someting like this :

Certificate vendors will typically ask you to paste the certificate request into a weborder form. This will be used as a public key to generate you private key. Please include the (BEGIN and END) tags when you paste the certificate request.

Please note that a cert of PKCS #7 format is required so that it can be imported back into keytool. (step 4)

The certificate vendor will then provide you with a certificate which that will look something like this:

Please paste this certificate into a file called your.host.com.cer [Note. please include the (BEGIN and END) tags]

Use the keytool to store the generated certificate :

Once step 4 is completed you now have a Universal Messaging server keystore and can add an SSL interface (see Creating an SSL network interface to a Universal Messaging Realm Server).

Please note that if you completed steps 1 to 4 for test certificates then you will also need to create a store for the CA root certificate as Universal Messaging will not be able to start the interface until it validates where it came from. Certificate vendors typically provide test root certificates which are not recognised by browsers etc. In this case you will need to add that cert to another store and use that as your cacert. When specifying certificates for a Universal Messaging SSL interface this would be specified as the Trust Store Path in the certificates tab.

If you are using anonymous SSL then you will have to provide this cacert to clients also as this will not be able to validate the Universal Messaging certificate without it. Please see the Security section of our Concepts guide for more information on configuring Universal Messaging clients to use certificates.