Generating an SSL/HTTPS key

Creating and installing a purchased SSL certificate

Large organizations might want to use their own SSL keyIn typical public key infrastructure (PKI) arrangements, a digital signature from a certificate authority (CA) attests that a particular public key certificate is valid (i.e., contains correct information). An SSL key can be either a public key (can be disseminated publicly) or a private key (known only to the owner). signed by a commercial certificate authority (CA) that is recognized by all popuplar web browsers including Internet Explorer, Mozilla Firefox, Safari and Chrome. A complete list is in Windows under Control Panel > Internet Options > Content > Certificates > Trusted Root Certification Authorities.

Some large organizations also operate a certificate authority of their own that is recognized by their users' web browsers by way of a root certificate that is installed into all users' web browsers in a manual or automated way.

The advantage of a signed certificate is that it eliminates the browser warning, "The security certificate presented by this website was not issued by a trusted certificate authority."

If you are already in possession of a signed SSL key and certificate for the domain name of the PaperCut Application ServerAn Application Server is the primary server program responsible for providing the PaperCut user interface, storing data, and providing services to users. PaperCut uses the Application Server to manage user and account information, manage printers, calculate print costs, provide a web browser interface to administrators and end users, and much more., see Importing an existing SSL key below.

The high-level steps are:

• Create the SSL keystore and create the private key

• Create the Certificate Signing Request (CSR)

• Send the CSR to your Certificate Authority

• Receive your signed certificate

  Optionally you will receive one or more intermediary certificates that you must install as well

• Install any intermediary certificates and then your new certificate

• Restart the PaperCut NG Application Server and confirm that everything is working as expected

To create your own SSL key and have it signed by a commercial or intra-organizational certificate authority you can use the 'keytool' tool supplied in the directory [app-path]/runtime/jre/bin.

1. Open a command prompt window and change to the directory [app-path]/runtime/jre/bin. Any existing files called 'my-ssl-keystore' in this directory are likely leftovers from previous attempts and need to be renamed or deleted at this point.

2. Enter this command to produce the SSL key:

   keytool -keystore [app-path]\server\custom\my-ssl-keystore -alias jetty -genkeypair -keyalg RSA

   Caution:

   This process creates a 'my-ssl-keystore' file. Don't lose this file! You need it when adding the public key later. We recommend making a copy of this 'my-ssl-keystore' and keeping it in a safe place. If it is lost or changed, your certificate needs to be re-issued, often resulting in costs from your Certificate Authority. If you are renewing your SSL certificate, review Renewing your SSL certificate

   As keystore password choose 'password' or another simple password as it is not very important. Enter the same password again later when asked for a key password.

   Note:

   Some organizations require larger key sizes than the default 1024 bit. In this case add the "-keysize 2048" or "-keysize 4096" parameter to the end of the above command line.

   You will be asked a series of questions. Enter the exact fully-qualified domain name of the PaperCut NG Application Server where it asks you for "first and last name". The server name must be the exact one that users will enter into their browsers to access PaperCut NG's web interface, e.g. 'printing.myschool.edu'. Depending on the certification authority's requirements, you might also need to fill in some of the other fields.

   Enter keystore password: password

   What is your first and last name?

   [Unknown]: printing.myschool.edu

   What is the name of your organizational unit?

   [Unknown]:

   What is the name of your organization?

   [Unknown]:

   What is the name of your City or Locality?

   [Unknown]:

   What is the name of your State or Province?

   [Unknown]:

   What is the two-letter country code for this unit?

   [Unknown]:

   Is CN=printing.myschool.edu, OU=Unknown, O=Unknown,

   L=Unknown, ST=Unknown, C=Unknown correct?

   [no]: yes

   Enter key password for <jetty>

   (RETURN if same as keystore password): password

3. Prepare your new SSL key for certification by the certificate autority:

   keytool -certreq -alias jetty -keystore [app-path]\server\custom\my-ssl-keystore

   -file [app-path]\server\custom\jetty.csr

   Paste the contents of the resulting jetty.csr into the online order forms of commercial certificate authorities or pass them to your organization's own certificate authority.

   When the certification process has completed, the authority provides you with a certificate file that you can download from the autority's web site. The filename usually ends in .crt, .cer or .cert. The contents of the file should look something like this:

   -----BEGIN CERTIFICATE----- MIIDLTCCApagAwIBAgIQJc/MOTjAW0HrPI/4rGtDCDANBgkqhkiG9w0BAQUFADCB

   hzELMAkGA1UEBhMCWkExIjAgBgNVBAgTGUZPUiBURVNUSU5HIFBVUlBPU0VTIE9O

   ... more here ...

   Awjhfz9EfxN2l1UYP15xZZyNO4DO3X/LliCG9pdFf4hUHl8tRnhQBvRR1F0v9UHB PC6L9jNjMbQUoQ9NG/S8Nn7ZcSHNy+P53ntIBaEfTv7+qvXNWvSb5wj4pd05wGF1

   Bw== -----

   END CERTIFICATE-----

   Save the file as jetty.crt.

   Caution:

   If you have not already, take the opportunity now to backup your my-ssl-keystore at this time.

4. Before you can make use of your newly obtained certificate, you might have to import the certificate authorities "root certificate". PaperCut comes with a number of root certificates pre-installed that you can list using this command (still from the directory [app-path]/runtime/jre/bin as above):

   keytool -keystore ../lib/security/cacerts -storepass changeit -list

   Add the option "-v" at the end to obtain the same list with more details, such as expiration dates.

   If your certificate authority is not listed there, or you have been notified that they have recently started using new root certificates, first import the certificate authority's root certificate into your keystore before importing your newly obtained own certificate. The CA's root certificate is available for download on the CA's web site as a file ending on .pem or .crt. Save the file using a filename indicative of the CA's name, e.g. globaltrust.pem. Import the root certificate using this command, specifying an alias that is indicative of the CA's name (type this all in one line):

   keytool -keystore [app-path]\server\custom\my-ssl-keystore -importcert -alias globaltrustroot -file globaltrustroot.pem

   When asked whether to trust this certificate, answer yes:

   Trust this certificate? [no]: yes

   Some certificate authorities also provide additional "intermediate certificates" that must be imported the same way as the root certificate. You should use a different alias each time. For example:

   keytool -keystore [app-path]\server\custom\my-ssl-keystore -importcert -alias globaltrustinter -file globaltrustinter.pem

5. Now you can import your own certificate previously saved as jetty.crt (type this all in one line):

   keytool -keystore [app-path]\server\custom\my-ssl-keystore -import -alias jetty -file jetty.crt -trustcacerts

   Caution:

   The 'my-ssl-keystore' in the above command is the original my-ssl-keystore you created in step 2.

6. Your new keystore file my-ssl-keystore is now ready. Move it to the location [app-path]/server/custom.

Now that you have your keystore file, follow the instructions in Configuring PaperCut to use the new certificate to install it and start serving up your new SSL certificate.