Each CommuniGate Pro Domain has its own PKI settings. They include
a Private Key associated with the Domain and Certificates containing the matching Public Keys.
To configure the Domain PKI settings, use the WebAdmin Interface to open the Domain Settings page for the
target Domain, and click the Security link. The PKI page will appear:
This option allows you to specify the PKI Mode for this Domain,
- No
- If this option is selected, PKI Functions for this Domain are disabled. If this option
is selected, all other Domain PKI settings have no effect.
- Test
- If this option is selected, the Server-wide Test Private key and Test Certificate are used for
this Domain. You do not have to configure any other Domain PKI
settings if this option is selected. Use this mode for testing purposes only.
The Server-wide Test Certificate uses the Server Main Domain name as its Subject and Stalker Software, Inc. as the Issuer.
The Test Certificate expires 30 days after the last Server restart time.
- Yes
- If this option is selected, the Domain PKI functions are enabled.
Assigning a Private Key
Initially CommuniGate Pro Domains do not have any Private Keys assigned. You should select the size
of the key and click the Generate Key button to create a random Private Key and assign it to
the Domain.
Note: depending on your server hardware platform, it can take up to several seconds
to generate a 2048-bit Key.
Only after you assign a Private Key, the Certificate-related fields will appear on the
Security page.
You can use any third-party program (such as OpenSSL) to generate a Private Key. You should
instruct that program to output the Private Key in the PEM format (as shown below).
Select "Custom" in the Size: menu and click the Generate Key button. A text field appears. Copy
the PEM-encoded Key into that text field, and click the Generate Key button:
Note: Make sure that the key you import is not password-encrypted. Something like the following
starting lines:
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-CBC,90C96A721C4E4B0B
GzLyio+Or3zXm1N7ILWlYDsR6cgPlzHomAxi6aeUthl4lSqBHaqMlh+/76I/6sNx
.................
indicate that the Private Key is encrypted and it cannot be imported into the Server.
If the Private Key is set correctly, and the Key can be used for
public/private key cryptography, you will see the following panel:
If the Key Test field indicates an error, the imported Private Key cannot be used
for public/private key cryptography.
Use the Remove button if you want to remove the entered Domain Private Key. Since the Domain
Certificate can be used with one and only one Private Ke, it becomes useless when you delete
the Private Key, so the existing Domain Certificate will be removed, too.
Assigning a Certificate
A Domain must have a Certificate to support PKI functions.
The Domain Certificate name (the Common Name part of the Certificate Subject field) should
match the domain name used by client applications.
If a CommuniGate Pro Domain has Domain Aliases, attempts to connect
to the Server using a Domain Alias name will result in warning messages on the client workstations
notifying users about the name mismatch. Since a Certificate can contain only one name,
select the name (the real Domain name or one of the Domain Aliases) that your users will use
in their client application settings. If your CommuniGate Pro Domain name is company.dom, and
that domain name does not have a DNS A-record, but the Domain has an Alias mail.company.dom
that has an A-record pointing to the CommuniGate Pro Server, your users will use the
mail.company.dom name in their client settings and WebUser Interface URLs, so the
Domain Certificate should be issued for the mail.company.dom name rather than
the company.dom name.
You may also use "wildcard" domain names for your certificates. If the Domain name has at least
2 components, the Common Name menu will contain a "wildcard" domain name:
the name of the Domain with the first component substituted with the asterisk (*) symbol.
If the Domain name has only 2 components, the asterisk component is added to form a 3-component name.
To create a Certificate, fill the fields in the Certificate Attributes table:
- Common Name
- When the Certificate is sent to a client application, the application checks that
the Certificate Common Name matches the name the user has specified in the URL and/or in the mailer settings.
- Contact E-mail
- This field must contain a valid E-mail address, though that address does not have
to be inside this CommuniGate Pro Domain.
All other fields are optional.
You can create a Self-Signed Certificate if you do not want to use any external
Certificate Authority.
Click the Generate Self-Signed button and the CommuniGate Pro Server creates a
Self-Signed certificate for you: the Issuer will be same entity you have specified,
and the entire Certificate will be signed using the Domain Private Key.
When a Domain has a Self-Signed Certificate, client applications will warn users
that the addressed server has presented a certificate "issued by an unknown authority".
Users can "install" self-signed certificates to avoid
these warnings.
You can Click the Generate Self-Signed button when a Self-Signed Certificate is
already assigned. In this case the Server creates a new Self-Signed Certificate with
the same serial number, but with new validity period.
To receive a Certificate from an external source ("trusted authority"),
click the Generate Signing Request button. A text field containing the PEM-encoded
CSR (Certificate Signing Request) will appear:
Copy the CSR text and submit it to the Certification Authority (CA) of your choice.
You can submit via E-mail or using a Web form on the CA site. The Certification Authority
should send you back the signed Certificate in the PEM-format. Enter that Certificate into
the bottom field and click the Set Certificate button.
If the Certificate is accepted, the Certificate information is displayed:
The Certificate panel shows the Certificate Issuer (the Certificate Authority),
the Certificate Subject (the data you have entered and the selected domain name),
the Certificate serial number and the validity period of this Certificate.
Note: the entered Private Key and Certificate will be used for the Domain
secure communications ONLY if the Secure Certificate To Use option is set to Yes.
Note: the Certificate contains the Domain name or a Domain Alias as a part of
the "Subject" data.
When you rename the CommuniGate Pro Domain, the domain name in the Domain Certificate does not
change, and the client applications may start to warn users about the name mismatch.
Click the Remove Certificate button to remove the Domain Certificate.
Assigning a Certificate Authority Chain
If the Certificate issuer is known to the users client software (mailers and browsers),
the warning message does not appear on the user screen when the client software receives
a Certificate from the Server. In many cases, the "trusted authority" does not issue
certificates itself. Instead, it delegates the right to issue certificates to some other,
intermediate authority. When your Server uses a Certificate issued by such an authority,
the Server should also present the Certificate of that authority issued by the "trusted
authority". The client software would check your Certificate first, then it will detect
that the issuer of your Certificate is not a "trusted authority" and it will check the
additional Certificate(s) the Server has sent. If that additional Certificate is issued
by a "trusted authority", and it certifies the issuer of your Domain Certificate, your
Certificate is accepted without a warning.
When you receive a Certificate from a Certificate Authority that is not listed as
a "trusted authority" in the client software settings,
that intermediate Certificate Authority (CA) should also give you its own Certificate
signed with a "trusted authority". That
Certificate should be in the same PEM format as your Domain Certificate:
The CA Chain may include several certifcates: the first one certifies the issuer
of the Domain Certificate you have entered, but it itself may be issued by some intermediate
authority. The next Certiciate certifies that intermediate authority, etc. The last Certificate
in the chain should be issued by some authority "known" to client software - usually,
some Root Authority.
If your CA Chain contains several separate PEM-encoded Certificates, enter all of them
into the Certificate Authority Chain field. The Certificate issued by a Root Authority should
be the last one in the list.
Click the Set CA Chain button to assign the Certificate Authority Chain to the Domian.
If all Certificates in the Chain are decoded successfully and their format is correct,
the CA Chain list is displayed:
Note: CommuniGate Pro checks only the format of each Certificate in the Chain.
It does not check that each Certificate really certifies the issuer of the previous Certificate and
that the last certificate in the Chain is issued by a Root Authority.
When set, the Certificate Authority Chain is sent to clients together with the Domain
Certificate.
Click the Remove CA Chain button to remove the Certificate Authority Chain from the Domain
Security Settings.
