You can replace the default Trellix DLP Network self-signed certificate with the certificate issued by a certificate authority (CA) or an intermediate CA so that other hosts on the network can validate the appliance's SSL certificate.
SSH must be enabled.
To replace the certificate, you can either:
Upload a new certificate and private key.
Download a certificate signing request (CSR) from the appliance, have it signed by a CA, and upload the certificate that the CA gives you.
Tip
Downloading a CSR from the appliance ensures that the appliance's private key can't be inadvertently exposed.
Only ECDSA and RSA certificates and keys are allowed in the uploaded file. The certificate must be suitable for use as both a TLS server and a TLS client and the upload must include the whole certificate chain. Uploads can be in the following formats:
PEM (Base64) — Certificate chain and private key or certificate chain only
PKCS#12 — Certificate chain and private key
PKCS#7 — Certificate chain only
If the upload format is PKCS#12 or PKCS#7, the correct file endings must be used:
PKCS#12 must have the file ending .p12 or .pfx.
PKCS#7 must have the file ending .p7b.
The certificate might fail to get installed if:
The certificate is not usable for its intended role.
The certificate has expired.
The uploaded file does not contain the CA certificates that it needs to verify it.
The certificate uses an unsupported public key algorithm, such as DSA.
If installation fails, detailed information is available in the appliance syslog. To view it, log on to the appliance console, select the Shell option, and type $ grep import_ssl_cert /var/log/messages.
In a browser, go to https://APPLIANCE:10443/certificates/ and select one of the CSR links for download.
Two files are available: one contains an RSA public key (the file ending in .rsa.csr) and the other contains an ECDSA public key (the file ending in .ec.csr).
Follow your CA's instructions to get the request signed.
Use an SCP client, such as winscp, to copy the root CA and any intermediate CA certificates used to sign the appliance certificate to the
/home/admin/upload/cacertdirectory on the appliance.You can see whether the installation succeeded or failed in the Client Events page.
Note
CA certificate and intermediate CA certificates must be imported before importing the appliance certificate.
Use an SCP client, such as WinSCP, to copy the signed appliance certificate to the
/home/admin/upload/certdirectory on the appliance.Note
The file transferred to the
/home/admin/upload/certfolder disappears on successful ingestion, which means that the ingestion utility has picked the file and processed it for later use. The file usually disappears even before you can access the folder to check the upload. But, if the file is present in this folder after the upload is complete, it indicates an error. You can also check whether the installation succeeded or failed from/var/log/messagesor the Client Events page.
The file gets installed automatically.