Creating a Let's Encrypt certificate in CMS

Prerequisites:

• The CMS must be able to access the Let's Encrypt signing CA over the internet.
• All GTO service names must be delegated in public DNS so that queries are resolved by the GTO authoritative servers.
• The Let's Encrypt signing CA MUST be able to access port 443 on all managed appliances public interface(s) (via NAT and is connected using name).

• All the managed appliances should be able to access port 443 in CMS.

To create a Let's Encrypt certificate in CMS

1. Log in to CMS.
2. Navigate to Management Server > Configure.

3. Click Edit under the SSL Certificates group.

4. In the General tab, click + icon and select Create Let's Encrypt certificateoption.

   

5. In the Fully qualified domain name field, enter the complete domain name. The FQDN entered here appears in the certificate and visible to users. You must also add FQDN to your DNS.

   Wildcard characters are not supported in the FQDN field.

6. In the Alternatives names field, enter any other name for FQDN. The alternative name entered here appears in the certificate using the Subject Alternative Name (SAN) certificate extension.

   Let's Encrypt supports up to 100 SANs per certificate.

7. In the Key type drop-down field, select the key type based on your requirement. The supported key types are RSA and EC.
8. In the Key size drop-down field, select the key size based on your requirement. The supported key sizes are 2048, 3072, and 4096 bits.
9. In the Signature drop-down field, select the secure hash algorithm based on your requirement. The supported signatures are SHA 512, SHA-384, and SHA-256.
10. Select Make this the default certificate check box. Selecting this check box replaces the default certificate for end user connections and moves the certificate to first in the list.

11. In order to use the Let's Encrypt free certificate authority service, you must agree to their terms of service. Select I agree to the Let's Encrypt terms of service check box.

    

    The Let's Encrypt certificate is created. You can view the Let's Encrypt certificate in AMC.

To view the certificate

1. Log in to AMC.

2. Navigate to System Configuration > SSL Settings.

   

Once you completed creating a Let's Encrpyt certificate, browse to the host name and ensure that the certificate is valid and verified.

Click More information to view the validity period and other details.

Renewing the certificate in CMS

The Let's Encrypt certificates are valid for 90 days and is renewed automatically after 60 days. You can also renew it manually based on your requirements.

To renew the certificate manually

1. Log in to CMS.

2. In the left panel, select Management Server > Configure.

3. Click Edit under the SSL Certificates group.

4. In the General tab, select the certificate you want to renew and click .

5. A success message is displayed and the certificate is renewed for the next 90 days. You can view the certificate validity displayed under Valid Through field.