I was pleased to learn a new feature was available in firmware 6.1, you can now assign a custom SSL certificate to the web administration page. I didn’t see this in the release notes but it was definitely a feature I’ve been waiting for. The Balance does not expose any ability to generate it’s own private key and provide you with a CSR that I could see, so you must provide it both a private and a public key. This can be a little bit arduous configuration for some, so here’s how to do this step by step from a Windows PC.
- Open up an MMC and add the certificates snap-in. I chose the local computer store but it probably doesn’t matter since we’re just using this temporarily to generate the certificates we need, we’ll delete everything here later.
- Right click the Personal store and choose All Tasks -> Advanced Operations -> Create Custom Request… and the Certificate Enrollment wizard appears.
- Step through the wizard. On the Select Certificate Enrollment Policy page, select “Proceed without enrollment policy” and hit next.
- On the custom request page accept the defaults (CNG key in PKCS #10 format) and hit next.
- The certificate information screen contains the link to the dialog where we’ll do the bulk of our work but it’s easy to miss (whoever designed this wizard I swear…). Click the “Details” disclosure triangle on the right side, then click the properties button. The certificate properties dialog appears.
- On the General tab you can put whatever you want, it doesn’t really have any bearing on the actual certificate.
- On the Subject tab, set your subject name fields as appropriate. At the minimum you’ll want to set the common name (FQDN of the appliance) and any of the locality fields your CA requires to be filled. I also set some alternative names, primarily the IP addresses for all WAN interfaces where I may access the balance by a specific IP directly. This is not strictly necessary but nice to have.
- On the Extensions tab, expand the extended key usage section and add the server authentication option.
- On the Private Key tab, you may set the options you wish for the private key. Expand the key options section, and make sure you choose “Make private key exportable”. If we can’t export the private key to give it to the Balance this exercise will be pretty useless. I also increased the key size to 2048 and chose SHA256 for the hash. I’m not sure what server side limitations there may be here on the Balance but these options are pretty standard. Also keep in mind what will be supported in your client side as some older OS/browsers may not support certain options as far as certificate validation goes. SHA256 should not be a problem though unless you’re still running XP SP2
- Click ok in the certificate properties dialog, then back in the certificate enrollment wizard click next.
- Pick where the save the CSR, leave the encoding as base 64, and click finish.
- Submit the CSR file to your CA and receive back your CA signed certificate. I used an internal Windows Server based CA for this purpose since it’s not public facing and I already had one in place. If you don’t have a CA and you don’t know how or don’t want to set one up yourself, you could get it signed by a public CA such as network solutions, godaddy, etc for a small fee.
- Import the certificate you received from your CA into the Windows certificate store where you generated the request. Make sure you import it into the same store (eg: local computer personal store).
- If you did everything right the certificate should show in the certificates MMC. If you look at the icon it will be a little certificate with a key in the top left corner signifying you possess the private key portion of the certificate. You can verify by double clicking the certificate and seeing that it says “You have a private key that corresponds to this certificate.”
- Now we must export the private key from the certificate store so we can import it on the Balance. Right click the certificate and choose All tasks -> Export… and the certificate export wizard appears.
- Step through the wizard. Choose yes to export the private key and click next.
- Unfortunately when exporting the private key we do not have the option to export it in the base 64 format we ultimately need. We’ll have to fix that later. For now leave the default format PKCS #12. Choose to include all the certificates in the certification path if possible and export all extended properties. You may optionally choose to delete the private key if the export succeeds. We will not need this in our certificate store when we’re done. Click next.
- Click the password check box and fill in a strong password. This password will protect the private key inside the PFX file. You will need this later so don’t forget it.
- We now have our certificate information in a PKCS #12 format in the .pfx file we exported. We need this in base 64 encoded PEM format to import into the Balance. To do this we will install and use an openssl utility. (Yes we could have just installed this from the start and used it to generate the private key and the CSR but I find it easier and faster to do from the Windows GUI)
- You can download and install a Windows compiled version of openssl from Win32/Win64 OpenSSL Installer for Windows - Shining Light Productions
- You will probably also need to install the Visual C++ 2008 redistributable from the same site first so follow the link on their website for that as well
- Once installed open a command prompt and go to C:\OpenSSL-Win32\bin\ or wherever you installed openssl to
- Run the following command to convert the file and enter your password when prompted: openssl pkcs12 -in c:\cert.pfx -out c:\cert.pem –nodes
- The -nodes option will leave the PEM file unencrypted. I did this to make it easier to import into the Balance but you can leave it off if you like. I have not tested that though.
- Open the PEM file in a text editor. You will notice some bag attribute sections as well as the private and public key(s).
- Open the Balance web admin page and navigate to Network -> Certificate Manager. Click assign next to Web Admin SSL Certificate.
- Paste the private key and surrounding bag attributes in the private key box, paste the public key(s) and surrounding bag attributes in the public key box. Fill in the password if the private key is encrypted.
- If you click show details you can verify it has read the key information correctly.
- Click save and apply local certificate.
- Done. No need to apply settings or anything. Close your browser window and reopen the web interface to test. If you assigned SANs test those too. At this point you should go either securely erase or securely back up the certificate information you exported from the Windows certificate store. You should note if you must replace or reflash your Balance in the future, you will lose the private key as it will not be exportable from the Balance. So make sure you back it up some place secure if you do not wish to reissue a new one later. Also note if you encrypted the private key on the file you are backing up you should make note of the password as well.
I hope this helps anyone in doubt about how to accomplish this.
