Let's Encrypt

Let’s Encrypt is a certificate authority that is public, free, API-driven, and trusted by browsers/clients. Integrating Let's Encrypt certificate with SMA enhances the security and eases the deployment process. Let's Encrypt certificates are valid for 90 days and are renewed automatically after 60 days.

In addition, integrating Let's Encrypt certificate with SMA helps to obtain the appropriate SSL certificates when configuring and deploying CMS with GTO.

Let's Encrypt certificates can be configured for standalone and CMS/GTO deployments where CMS manages the Let’s Encrypt certificate(s) for the cluster.

Prerequisites:

• The appliance must be able to access the Let's Encrypt signing CA over the internet.
• Let's Encrypt signing CA must be able to resolve all the Subject Alternative Name (SAN) names included in the certificate in public DNS.
• All the SAN names must resolve to the public IP address of the standalone appliance.
• The Let's Encrypt signing CA must be able to access port 443 on the public interface (or via NAT, as long as the name resolves).
• The Let's Encrypt must be generated after registering all the SMA appliances and all the GTO services configuration

Creating a Let's Encrypt certificate in CMS

Prerequisites:

• The CMS must be able to access the Let's Encrypt signing CA over the internet.
• All GTO service names must be delegated in public DNS so that queries are resolved by the GTO authoritative servers.
• The Let's Encrypt signing CA MUST be able to access port 443 on all managed appliances public interface(s) ( or via NAT and the appliances must be able to access the CMS on port 443).

To create a Let's Encrypt certificate in CMS

1. Log in to CMS.
2. Navigate to Management Server > Configure.

3. Click SSL Settings.

   The SSL Settings page displays,

4. Under the SSL Certificates group, click Edit.

5. In the General tab, click + New and select Create Let's Encrypt certificateoption.

   

6. In the Fully qualified domain name field, enter the complete domain name. The FQDN entered here appears in the certificate and visible to users.

   Wildcard characters are not supported in the FQDN field.

7. In the Alternatives names field, the SAN list is prepopulated for all the required domain names or enter any other name for FQDN. The alternative name entered here appears in the certificate using the SAN certificate extension.

   Let's Encrypt supports up to 100 SANs per certificate.

8. In the Key type drop-down field, select the key type based on your requirement. The supported key types are RSA and EC.
9. In the Key size drop-down field, select the key size based on your requirement. The supported key sizes are 2048, 3072, and 4096 bits.
10. In the Signature drop-down field, select the secure hash algorithm based on your requirement. The supported signatures are SHA 512, SHA-384, and SHA-256.
11. Select Make this the default certificate check box. Selecting this check box replaces the default certificate for end user connections and moves the certificate to first in the list. If using GTO, this will generate the new Let's Encrypt certificate to all managed appliance and make it as a default certificate in appliances.

12. In order to use the Let's Encrypt free certificate authority service, you must agree to their terms of service. Select I agree to the Let's Encrypt terms of service check box.

    

    The Let's Encrypt certificate is created. You can view and modify the Let's Encrypt certificate.

    

To view the certificate

1. Log in to CMS.

2. Navigate to Management Server > Configure.

3. Click SSL Settings.

   The SSL Settings page displays,

4. Under the SSL Certificates group, click Edit.

5. In the General tab, under Certificate Usageoption.

   Once you completed creating a Let's Encrpyt certificate, browse to the host name and ensure that the certificate is valid and verified

   

   

   Click More information to view the validity period and other details.

   

Renewing the certificate

The Let's Encrypt certificates are valid for 90 days and is renewed automatically after 60 days. You can also renew it manually based on your requirements.

To renew the certificate manually

1. Log in to CMS.
2. In the left panel, select Management Server > Configure > SSL Settings.

3. Click Edit under the SSL Certificates group.

4. In the General tab, select the certificate you want to renew and click .

   A success message is displayed and the certificate is renewed for the next 90 days. You can view the certificate validity displayed under Valid Through field.