##### To set up TLS using a Certificate Authority (CA) certificate NOTES TLS is a more recent version of Secure Sockets Layer (SSL). For a list of trusted Certificate Authorities, open Internet Explorer, then select Tools or > Internet Options > Content > Certificates > Trusted Root Certificate Authorities.
Click for details below Step 1: Create a key and certificate Step 2: Obtain a CA certificate Step 3: Install the certificate Step 4: Verify that TLS is enabled in your web browser
###### Step 1: Create a key and certificate In SiteBuilder, select Configure > Preferences > Web Server. Select HTTPS Only in the Enabled Web Server Ports field. NOTE For quicker navigation, select Both HTTP and HTTPS if operators will connect to the system from an internal network and the Internet or if you are using Hierarchical Servers. Change the setting in the HTTPS Port field only if the system will be using a non-standard port. Click Delete Certificate. CAUTION Clicking this button will delete all certificates in your system. Click Make Certificate. In the Make Certificate dialog box, type a Keystore password. In the DNS name of your server field, type the address of the server using one of the following formats: • The domain name if accessing through the Internet. Example: ``www.abi.com``. • The IP address if accessing through the Internet. Example: ``216.227.49.36``. • The computer name if accessing internally. Example: ``mycomputerxp``. NOTE The address format you use in this field is the format operators must use to access the system in a web browser. The next 5 fields are optional, but the more information you enter, the more secure your key is. Click Apply. In the Keystore Password field, type the password that you entered in step 5 above. NOTE This field is case sensitive. Click OK.
###### Step 2: Obtain a CA certificate Create a Certificate Signing Request (CSR). In the WebCTRL® server's Start menu, select All Programs > Accessories > Command Prompt. Type the following command as a single line of text, replacing <x.x> with the system's version number: ``C:\WebCTRL<x.x>\bin\java\jre\bin\`` ``keytool.exe -certreq -alias WebCTRL -keystore`` ``C:\WebCTRL<x.x>\webserver\keystores\certkeys -file`` ``C:\WebCTRL<x.x>\webserver\keystores\request.csr`` Press Enter. This creates a request.csr file located in ``C:\WebCTRLx.x\webserver\keystores``. Get a certificate from a certificate authority (typically from their website). The CA will ask you to send a copy of the CSR file (request.csr). Or, the CA may ask you to paste the contents of the request.csr file into their website. You will receive the following files from your CA. Copy these .cer files to the WebCTRLx.x folder: A chain or root certificate One or more intermediate certificates (Not all CA's provide intermediate certificates.) A received certificate See NOTE at the bottom of this topic. Import the root certificate. In the WebCTRL® server's Start menu, select All Programs > Accessories > Command Prompt. Type the following command as a single line of text, replacing <x.x> with the system's version number and ``<root.cer>`` with the name of the root certificate file: ``C:\WebCTRL<x.x>\bin\java\jre\bin\`` ``keytool.exe -import -trustcacerts -alias root`` ``-keystore C:\WebCTRL<x.x>\webserver\keystores\certkeys -file \WebCTRL<x.x>\<root.cer>`` Press Enter. The information for the root key is displayed and you are prompted to trust this certificate. Type ``yes``. If the CA provided an intermediate certificate, import that certificate. In Command Prompt, type the following command as a single line of text, replacing <x.x> with the system's version number and <intermediate.cer> with the name of the intermediate certificate file: ``C:\WebCTRL<x.x>\bin\java\jre\bin\`` ``keytool.exe -import -trustcacerts -alias intermed`` ``-keystore C:\WebCTRL<x.x>\webserver\keystores\certkeys -file \WebCTRL<x.x>\<intermediate.cer>`` Press Enter. NOTE If the CA provided more than one intermediate certificate, repeat step 5 for each one. Replace``-alias intermed`` with``-alias intermed1``,``-alias intermed2``, etc. Import the received certificate. In Command Prompt, type the following command as a single line of text, replacing <x.x> with the system's version number and``<received.cer>`` with the name of the received certificate file: ``C:\WebCTRL<x.x>\bin\java\jre\bin\`` ``keytool.exe -import -trustcacerts -alias WebCTRL`` ``-keystore C:\WebCTRL<x.x>\webserver\keystores\certkeys -file \WebCTRL<x.x>\<received.cer>`` Press Enter. NOTE If you are not sure which file is which certificate, double click each .cer file. Go to the Certificate Path tab. If you see: Only 1 entry, this is your root certificate. Multiple entries but the last one is your domain name, this is your received certificate. Multiple entries but the last one is not your domain name, this is an intermediate certificate.
###### Step 3: Install the certificate Start the WebCTRL® Server application (this may take up to a minute), then do the appropriate steps below on each workstation that will access WebCTRL Server. Start your browser. In the address bar, type the URL of the server running the WebCTRL® application using the server address that you entered in Step 1: Create a key and certificate. Use the TLS indicator ``https`` instead of ``http``. For example, ``https://216.227.49.36``. Do one of the following: If the TLS certificate is valid and trusted by the browser, skip to Step 4: Enable TLS in your web browser. If the certificate is not valid or not trusted by the browser, follow the steps below for your browser. Internet Explorer® If the page displays There is a problem with this website's security certificate, click Continue to this website. In the address bar, click Certificate Error. Click View Certificates, then click Install Certificate. In the Certificate Import Wizard, click Next. Select Place all certificates in the following store. Click Browse, then select Trusted Root Certification Authorities. Click OK. Click Next. Click Finish. Click Yes in the Security Warning dialog box to install the certificate. Click OK. Click OK again. Close Internet Explorer, then open it again. Log in to the WebCTRL® interface. GoogleTM ChromeTM If the page displays Your connection is not private, follow the steps below. Export certificate to a known location: Press F12 to bring up the Developer Tools pane. Navigate to the Security tab, and then click View Certificate. On the Details tab, click Copy to File. In the Certificate Export Wizard, click Next. Choose an option, then click Next. Click Browse. In the File Name field, type a name for your export file. Click Save. Click Next. Click Finish. In the message box The export was successful, click OK. Click OK again Press F12 to close the Developer Tools pane. Import saved certificate: Click on the browser toolbar, then select Settings. Click Advanced. Scroll down to Privacy and security, then click Manage certificates. On the Trusted Root Certification Authorities tab, click Import. In the Certificate Import Wizard, click Next. Click Browse, then select the file you exported in step 2. Click Open. Click Next. Select Place all certificates in the following store. Click Browse, then select Trusted Root Certification Authorities. Click OK. Click Next. Click Finish. Click Yes in the Security Warning dialog box to install the certificate. In the message box Import was successful, click OK. Click Close. Close Chrome, then open it again. Log in to the WebCTRL® interface. Mozilla® Firefox® If the page displays This Connection is Untrusted, expand I understand the Risks, then click Add Exception. Check Permanently store this exception. Click Confirm Security Exception. Close Firefox, then open it again. Log in to the WebCTRL® interface. Safari® If the page displays the message, Safari can’t verify the identity of the website, click Show Certificate. Check Always trust <DNS name you entered in SiteBuilder> when connecting to <WebCTRL Server address>. Click Continue. Enter the administrator password for your Apple® device. Click Update Settings.
###### Step 4: Verify that TLS is enabled in your web browser The WebCTRL® application attempts to use TLS when communicating with a web browser. The web browser must be set up for TLS. GoogleTM ChromeTM, Mozilla® Firefox®, and Safari® use TLS by default. In the Internet Explorer® security options: Verify that Use TLS 1.x is checked. Verify that SSL 2.0 and SSL 3.0 are not checked.