HP - CPA 1.0

1. Create a directory (IISCertificate) under your home folder.

2. Create a 2048-bit key to be used when creating your CA.

   Copy Code

   openssl genrsa -des3 -out ca.key 2048

   

You will be asked to supply a pass phrase for ca.key. The pass phrase will be requested whenever you use the CA certificate so make sure you remember it. This will create a file called “ca.key” that contains your certificate authority private key.

3. Create the CA certificate request.

   Copy Code

   openssl req -new -x509 -days 4000 -key ca.key -out ca.cer

   

   1. When you are asked to enter a pass phrase, make sure you enter the pass phrase used in step 2. The output CA certificate will be generated in “ca.cer”.

The certificate is updated automatically on deployed printers, and is sent automatically with newly installed printers.

1. Create a 2048-bit key to be used when creating the server certificate.

   Copy Code

   openssl genrsa -des3 -out server.key 2048

   

   You will be asked to supply a pass phrase. The pass phrase will be requested whenever you use this certificate so make sure you remember it. This will create a file called “server.key,” containing your server private key.

2. Create the server certificate request.

   Copy Code

   openssl req -extensions ssl_server -new -key server.key -extensions usr_cert -out server.csr

   

   1. When you are asked to enter a pass phrase for “server.key,” make sure you enter the pass phrase used in step 1, which creates the server certificate request “server.csr.”
   2. The “Common Name” has to match the Fully Qualified Domain Name (FQDN) of the Web server.” A quick way to get this info is by executing the following command: “nslookup <WebServer_IP_address>.”

3. Sign the certificate signing request (csr) with the self-created certificate authority (CA) that you made earlier by running the following command:

   Copy Code

   openssl x509 -req -startdate -days 365 -in server.csr -CA ca.cer -CAkey ca.key -extensions usr_cert -out server.crt -CAcreateserial

   By using the “-startdate” parameter, you are signing the certificate against the current date/time. Make sure that your environment has the correct date/time and time zone setup. If an error comes back for fopen:No such file or directory:bss_file.c:398:fopen('ca.srl', 'r'), then add -CAcreateserial to the command.

   1. When you are asked to enter a pass phrase for “ca.key,” make sure you enter the pass phrase used in step 1. This will create the server certificate “server.crt.”

4. Generate a .PFX file / PKCS#12 certificate

   Copy Code

   openssl pkcs12 -export -in server.crt -inkey server.key -certfile ca.cer -name <FQDN> -out serverCert.pfx

   Ensure you replace <FQDN> with your Virtual Appliance FQDN, used in step 2.

   1. When you are asked to enter a pass phrase for “server.key,” make sure you enter the pass phrase used in step 1. This will create the “serverCert.pfx” file. You will then be asked to supply an export password that to use when uploading the certificate in the printer's web portal.

5. Upload the PFX file into the printer's web portal.

   The printer's web portal is accessed by browsing to the printer's IP address.

   1. In the printer's web portal, navigate to the Security tab.
   2. Select Certificate Management.
   3. In the Install Identity Certificate section, select Import Identity Certificate with Private Key.
   4. Upload the serverCert.pfx file using the export password you created.
   5. Select Install.
   6. Once the upload is complete, you will be able to scroll down and see the FQDN listed under the Issued To field.