Obtaining Certificates from a Public Certificate Authority (CA)

Email security allows users to connect securely via a web browser. This is done through the support of the HTTPs protocol. In the process, a certificate is sent from the server (Email Security) to the client (the user’s browser). The user utilizes the certificate to encrypt and secure its communication to Email Security.

Email security includes a self-signed certificate. This is very handy because it allows encrypted communication without the requirement to install a certificate. However, a public certificate issued by a Certificate Authority (CA) is a better option because users accessing Email Security with a browser will not get an invalid certificate authority warning from the browser. This in turn helps prevent man-in-the-middle attacks.

The rest of this document describes the process to obtain and validate the certificate.

Certificate Requirements

1. A cert from a CA in a P7B format. ( See process if not in P7B format)
2. Must be properly chained and include the intermediate and CA certificates.
3. Must be requested for Apache Tomcat.
   
   

The Process
Obtain the CSR from Email Security

CSR is the Certificate Signing Request:

1. Log into the Email Security appliance or software
2. Browse to the System | Certificates | Generate CSR
3. Fill out the form below company’s information
4. Click on Generate CSR.  Note: The button should not be pressed more than once.  Otherwise, the certificate will not work.
5. Copy the text in the Certificate Signing Request window and save into a text file.  This information will be supplied to the CA as part of the process to obtain the certificate.
6. Close the window from which you copied the text for the CSR, do not click the apply button.

Submit CSR to the Certificate Authority

1. Submit both company information and the CSR request from the CA
2. Choose Apache if that option is available, otherwise, choose Tomcat.
3. Obtain the Certificate
4. Validate the certificate by using the Windows MMC certificate plugin to import the Cert along with the chain of certificates leading to the Certificate Authority. (It may be necessary to chain the certificate received with the intermediate and root CA certs since most will only give you the cert you requested, see the providers directions from their web site. )
5. Export and include all certificates in the export in P7B format.

1. Import Certificate into Email Security
   
   Before importing the new certificate or a replacement for an expired cert, it is important the (Redirect access from http to https) check box is not checked. The Apache tomcat web server used by Email Security may not operate properly if the redirect option is enabled.
   
   1.       Log into the Email Security appliance or software
   
   2.       Browse to the System | Certificates | Generate/Import
   
   3.       Select the third option radio button " Import an existing certificate issued by a trusted authority like RapidSSL, Verisign and other CAs. The product supports PKCS #12 (.p12 or .pfx), PKCS #7 and PEM formats."
   4.       Click on the Browse button
   
   5.       Browse to upload the certificate
   
   6.       Click on Generate/ Import
   
   7.       Once the Certificate is imported it will appear on the list of certificates under System | Certificates | Configure
   
   8.       Select the New certificate from the list for SMTP/ TLS or HTTPS pr both as required and Click Apply

Verify Certificate Installation

If the new certificate was not applied, it is normally an indication of a problem in the chaining process (the certificates were not imported in the proper order).  You can call SonicWall Technical support for further assistance.