Secure Mobile Access 12.4 CMS Administration Guide

Let's Encrypt

Let’s Encrypt is a certificate authority that is public, free, API-driven, and trusted by browsers/clients. Integrating Let's Encrypt certificate with SMA enhances the security and eases the deployment process. Let's Encrypt certificates are valid for 90 days and are renewed automatically after 60 days.

In addition, integrating Let's Encrypt certificate with SMA helps to obtain the appropriate SSL certificates when configuring and deploying CMS with GTO.

Let's Encrypt certificates can be configured for standalone and CMS/GTO deployments where CMS manages the Let’s Encrypt certificate(s) for the cluster.

Prerequisites:

  • The appliance must be able to access the Let's Encrypt signing CA over the internet.
  • Let's Encrypt signing CA must be able to resolve all the Subject Alternative Name (SAN) names included in the certificate in public DNS.
  • All the SAN names must resolve to the public IP address of the standalone appliance.
  • The Let's Encrypt signing CA must be able to access port 443 on the public interface (via NAT, as long as the name resolves).

Creating a Let's Encrypt certificate in CMS

Prerequisites:

  • The CMS must be able to access the Let's Encrypt signing CA over the internet.
  • All GTO service names must be delegated in public DNS so that queries are resolved by the GTO authoritative servers.
  • The Let's Encrypt signing CA MUST be able to access port 443 on all managed appliances public interface(s) (via NAT and is connected using name).

To create a Let's Encrypt certificate in CMS

  1. Log in to CMS.
  2. Navigate to Management Server > Configure.
  3. Click Edit under the SSL Certificates group.

  4. In the General tab, click + icon and select Create Let's Encrypt certificateoption.

  5. In the Fully qualified domain name field, enter the complete domain name. The FQDN entered here appears in the certificate and visible to users. You must also add FQDN to your DNS.

    Wildcard characters are not supported in the FQDN field.

  6. In the Alternatives names field, enter any other name for FQDN. The alternative name entered here appears in the certificate using the Subject Alternative Name (SAN) certificate extension.

    Let's Encrypt supports up to 100 SANs per certificate.

  7. In the Key type drop-down field, select the key type based on your requirement. The supported key types are RSA and EC.
  8. In the Key size drop-down field, select the key size based on your requirement. The supported key sizes are 2048, 3072, and 4096 bits.
  9. In the Signature drop-down field, select the secure hash algorithm based on your requirement. The supported signatures are SHA 512, SHA-384, and SHA-256.
  10. Select Make this the default certificate check box. Selecting this check box replaces the default certificate for end user connections and moves the certificate to first in the list.
  11. In order to use the Let's Encrypt free certificate authority service, you must agree to their terms of service. Select I agree to the Let's Encrypt terms of service check box.

    The Let's Encrypt certificate is created. You can view and modify the Let's Encrypt certificate in AMC.

To view the certificate

  1. Log in to AMC.
  2. Navigate to System Configuration > SSL Settings.

Once you completed creating a Let's Encrpyt certificate, browse to the host name and ensure that the certificate is valid and verified.

Click More information to view the validity period and other details.

Renewing the certificate

The Let's Encrypt certificates are valid for 90 days and is renewed automatically after 60 days. You can also renew it manually based on your requirements.

To renew the certificate manually

  1. Log in to CMS.
  2. In the left panel, select Management Server > Configure.
  3. Click Edit under the SSL Certificates group.

  4. In the General tab, select the certificate you want to renew and click .

    A success message is displayed and the certificate is renewed for the next 90 days. You can view the certificate validity displayed under Valid Through field.

Was This Article Helpful?

Help us to improve our support portal

Techdocs Article Helpful form

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.