Replacing the NGINX certificates

Access the appliance shell.

Log in to the Network Investigator appliance as npadmin and enter the privileged shell.

$ ssh npadmin@<APPLIANCE_IP_OR_FQDN>
 hostname> enable
 [sudo] password for npadmin: <password>
 hostname# shell 

Note

Before uploading your server certificates and key file to the NI appliance, change the filenames to match the following:

• Server certificate filenames: server.crt and server.csr

• Key certificate filename: server.key

Create a backup directory.

Create a dedicated folder in the /root directory to store backup copies of the existing certificates.

[root@hostname ~]# mkdir /root/backup_cert

Copy the current certificates.

Copy the existing server.crt, server.csr, and server.key from the default NGINX certificate directory to your new backup folder.

[root@IA123 ~]# cp -p /data/config/ia/certs/server.key /root/backup_cert/server.key        
[root@IA123 ~]# cp -p /data/config/ia/certs/server.crt /root/backup_cert/server.crt        
[root@IA123 ~]# cp -p /data/config/ia/certs/server.csr /root/backup_cert/server.csr

Create a working directory.

Create a separate, temporary directory to generate your new certificate files.

[root@hostname ~]# mkdir /root/new_cert
[root@hostname ~]# cd /root/new_cert 

Create the OpenSSL configuration file.

You must create a configuration file to define the certificate details, including the mandatory SANs. Create a file named openssl.cnf using a text editor like vi.

Paste the following content into the file. You must customize the values in the [req_distinguished_name] and [alt_names] sections to match your organization and appliance details.

[ req ]
 prompt = yes
 default_bits = 2048
 distinguished_name = req_distinguished_name
 req_extensions = v3_req
[ req_distinguished_name ]
 countryName = Country Name (2 letter code)
 countryName_default = IE
 stateOrProvinceName = State or Province Name (full name)
 stateOrProvinceName_default = Cork
 localityName = Locality Name (eg, city)
 localityName_default = Mahon Point
 organizationName = Organization Name (eg, company)
 organizationName_default = FireEye
 organizationalUnitName = Organizational Unit Name (eg, section)
 organizationalUnitName_default = Network Forensics
 commonName = Common Name (eg, your name or your server's hostname)
 commonName_max = 64
 commonName_default = IA123
 emailAddress = Email Address
 emailAddress_max = 64
 emailAddress_default = user@domain.com
[ v3_req ]
 subjectAltName = @alt_names
[alt_names]
 IP.1 = 192.168.0.123
 DNS.1 = 192.168.0.123
 DNS.2 = IA123
 DNS.3 = IA123.corklabs.local

Generate the private key and a Certificate Signing Request.

Run the following command to generate your new private key (server.key) and CSR (server.csr) using the configuration file you just created.

[root@hostname new_cert]# openssl req -out server.csr -newkey rsa:2048 -nodes -keyout server.key -config openssl.cnf

Submit the CSR to your Certificate Authority.

The command in the previous step creates two files: server.key and server.csr. Provide the contents of the server.csr file to your CA to receive a signed server certificate. You can view the contents of the file using the cat command.

Upload the certificate files.

Using an SCP client, upload your new signed certificate (server.crt) and the CA chain certificate (ca.crt) to the /home/npscp directory on the appliance.

Note

The CA certificate file (ca.crt) should be a base64 PEM-encoded file. If you have a certificate chain, the file should contain the intermediate certificate first, followed by the root CA certificate.

Verify the certificate files.

This step is highly recommended to prevent errors. The server certificate, private key, and CSR all contain a Modulus value that must match. Use the commands below to diagnose a key mismatch. The output hash from all three commands must be identical.

# Run the verification commands
 [root@hostname new_cert]# openssl rsa -noout -modulus -in server.key | sha256sum
 [root@hostname new_cert]# openssl req -noout -modulus -in server.csr | sha256sum
 [root@hostname new_cert]# openssl x509 -noout -modulus -in server.crt | sha256sum 

Move files and set permissions.

Create a dedicated directory for the custom certificate, copy the key and certificate files into it, and set the correct ownership and permissions.

# Create the customer certificate directory
 [root@hostname ~]# mkdir -p /opt/npulse/certs/customer
# Copy the key and certificate to the new directory
 [root@hostname ~]# cp /root/new_cert/server.key /opt/npulse/certs/customer/
 [root@hostname ~]# cp /root/new_cert/server.crt /opt/npulse/certs/customer/
 [root@hostname ~]# cp /root/new_cert/server.csr /opt/npulse/certs/customer/
# Set ownership to root
 [root@hostname ~]# chown root:root /opt/npulse/certs/customer/*
# Set secure file permissions
 [root@hostname ~]# chmod 0644 /opt/npulse/certs/customer/server.crt
 [root@hostname ~]# chmod 0644 /opt/npulse/certs/customer/server.csr
 [root@hostname ~]# chmod 0400 /opt/npulse/certs/customer/server.key

Note

The .crt and .csr files require 0644 permissions, while the .key file requires 0400 permissions.

Configure NGINX.

Activate the new certificate.

Test the NGINX configuration for syntax errors and then restart the service to apply the changes.

[root@hostname ~] # systemctl stop openresty.service
[root@hostname ~] # systemctl daemon-reload
[root@hostname ~] # systemctl start openresty.service

Your appliance is now configured to use the new custom certificate. You can verify this by navigating to the Web UI in your browser and inspecting the certificate details.