Use an existing IIS certificate
If your organization's intranet is served by Internet Information Server (Windows), Apache (Linux), or another web server, you might be able to use the IIS certificate for PaperCut MF.
You can use an existing IIS certificate if either:
- your intranet server and PaperCut MF Application server run on the same server, that is, they have the same server name and address
- you have a wild-card certificate that allows arbitrary subdomains under the domain name (for example, myschool.edu) for which it was issued
Step 1: Export the existing certificate with key
-
Open the Windows management console, select your IIS server; then open "Server Certificates".
-
Right-click the certificate; then click Export.
-
Choose a filename with the extension .pfx. (This is just temporary, you MUST delete this file later on.)
-
Type a password for the PFX file. This is only used temporarily.
-
Click OK.
Step 2: Import the certificate into the PaperCut MF keystore
The way in which you import your trusted certificate into the PaperCut MF keystore depends on the type of certificate you have:
PEM/CERT/CER file
- Use the tool create-ssl-keystore to import the key/certificate. An example of the command's use:
cd [app-path]/server/bin/win
create-ssl-keystore -f -cert <certificate file path> -key <key file path> -keypass <keyfile passwordkeyfile>
More information is available via the --help command line option.
Usage: create-ssl-keystore [-f] [-cert FILE] [-key FILE] [-keypass PWD] [-certCA FILE....]
-f: Force. Overwrite any existing keystore file.
-cert FILE: Creates a keystore for a given custom certificate file.
Must be used in conjunction with -key argument.
-key FILE: Creates a keystore for a given custom private key file.
-keypass pwd: Specifies the password accompanying the private key.
-certCA FILE: Specifies one or more optional issuer (CA) certificate to include
PFS/PKCS#12 file
- Use the tool create-ssl-keystore to import the key/certificate. An example of the command's use:
cd [app-path]/server/bin/win
create-ssl-keystore -f -p12 "path/to/pfx.pfx" -p12pass password -k "path/to/custom/folder/my-ssl-keystore"
More information is available via the --help command line option.
Usage: create-ssl-keystore [-f] [-p12 FILE] [-p12pass PWD] [-k FILE
-f: Force. Overwrite any existing keystore file.
in the default location (server/data/default-ssl-keystore).
-p12 FILE: Creates a keystore for a given custom private key file.
-p12pass pwd: Specifies the password accompanying the private key.
-k FILE: Define a keystore file location. If not set, the keystore is created
Step 3: Configure the PaperCut MF keystore
Changes are not applied until the PaperCut MF Application ServerAn Application Server is the primary server program responsible for providing the PaperCut user interface, storing data, and providing services to users. PaperCut uses the Application Server to manage user and account information, manage printers, calculate print costs, provide a web browser interface to administrators and end users, and much more. is restarted.
To configure the PaperCut Application Server to use the new key/certificate:
-
Copy your signed keystore onto the server running the PaperCut MF Application Server. The suggested location is [app-path]/server/custom/my-ssl-keystore
-
Open the file [app-path]/server/server.properties with a text editor (e.g. Notepad).
-
Remove the # (hash) comment marker from all lines starting with "server.ssl".
-
Define the location of your keystore, keystore password and key password as chosen previously. The file should look something like this:
server.ssl.keystore=custom/my-ssl-keystore
server.ssl.keystore-password=default
server.ssl.key-password=default
NOTE: On Mac OS, specify the FULL path to your keystore, e.g. /Applications/PaperCut MF/server/custom/my-ssl-keystore
-
Restart the PaperCut MF Application Server and verify all is working. If the server fails to start, error messages are recorded in logs located in the server's logs directory.
Now that you have a working SSL certificateSSL certificates are small data files that digitally bind a cryptographic key to an organization’s details, such as a company's domain name, your company name, your address, your city, your state and your country. When installed on a web server, it activates the padlock and the HTTPS protocol (over port 443) and allows secure connections from a web server to a browser. When a browser connects to a secure site it retrieves the site's SSL certificate and checks that it has not expired, it has been issued by a Certification Authority the browser trusts, and that it is being used by the website for which it has been issued. If it fails on any one of these checks the browser will display a warning to the end user letting them know that the site is not secured by SSL. SSL certificates can be either self-signed or CA signed. for your PaperCut MF server, it's time to set a reminder in your calendar (or similar) to ensure that your SSL certificate is renewed before it expires! Go do that now!