Obtaining a CA certificate from a trusted public certificate authority (CA)

This section describes how to obtain a CA certificate and CA bundle issued by a trusted public certificate authority (CA).

The CA certificate validates the ownership of the public key contained within the certificate. The public key is used to establish trusted communication between the appliance and the Web browsers running the Web UI, the Email Security — Server appliance and a downstream MTA, and the File Protect appliance and a WebDAV server.
The CA bundle includes the root and intermediate certificates between the holder of the CA certificate and the public CA. This bundle constitutes the CA certificate's chain of trust.

In this procedure, you generate three files:

An encrypted private key used to decrypt your certificate.
An unencrypted copy of the private key that you import into the appliance and then delete. (You cannot import an encrypted private key into the appliance.)
A Certificate Signing Request (CSR) used to request your certificate.

Note

The example in this section creates a private 2048-bit key named fireeye.key that is encrypted with DES3. OpenSSL is used to create the private key and the CSR.

Prerequisites

System with OpenSSL installed

To obtain a CA certificate:

Create a private key:
```
OpenSSL> genrsa -des3 -out fireeye.key 2048
```
When prompted, enter a passphrase you will remember, and then enter it again to confirm it.
Create an unencrypted (unlocked) copy of the private key.
```
OpenSSL> rsa -in fireeye.key -out fireeye-unencrypted.key
```
When prompted, enter the passphrase you entered in the previous step.
Create the CSR:
```
OpenSSL> req -new -key fireeye.key -out fireeye.csr
```
or
```
OpenSSL> req -new -key fireeye-unencrypted.key -out fireeye.csr
```
If you entered the command with the encrypted key, enter the passphrase you provided in the first step.
If you are using the Chrome browser, you need to add the Subject Alternative Name and Alt Names to the new key. For example:
```
[v3_req]
```
```
basicConstraints = CA:FALSE
```
```
subjectAltName = @alt_names
```
```
[alt_names]
```
```
DNS.1 = dnstest.dns.local
```
```
DNS.2 = dnstest
```
When prompted, provide information for the CSR:
- Country Name—Two-letter country code.
- State or Province Name—Full name, not an abbreviation.
- Locality Name—City where your organization is located.
- Organization Name—Name of your organization.
- Organizational Unit Name—Section or department in the organization.
- Common Name—Fully qualified domain name for the appliance (for example, fireeye.acme.com). The domain must be accessible over the Internet.
- Email address (optional)—Press Enter to skip.
- Challenge password—Do not provide. Press Enter to skip.
- Optional company name (optional)—Press Enter to skip.
Locate the fireeye.csr file in your local file system, and send it to the public CA.
Receive the following from the public CA:
- Signed CA certificate (saved as fireeye.cer)
- CA bundle
- Base-64 encoded copy of the root CA certificate

Important

Be sure to delete the unencrypted copy of the private key after you import it into the appliance.