The built-in functionality of BeaconMonitorConfigurationTool.exe bundled with Beacon Monitor, is enough for simple certificate management:
However, for more control over generating the certificate it may be preferable or offer greater flexibility, to use a 3rd party tool such as OpenSSL to generate the request. Other tools are also possible, but for the purposes of this guide OpenSSL is primarily used and the CA is Windows Certification Authority.
OpenSSL can be installed easily using Chocolately package manager (https://chocolatey.org/install) or installed manually, to install OpenSSL using Chocolately:
choco install openssl
The outcome of this should be a CA-signed certificate and key pair:
The result should be a 'valid and trusted certificate' and no warning related to the certificate in any supported browser:
New-Item -ItemType Directory mycert
Set-Location mycert
[req_distinguished_name] countryName = GB stateOrProvinceName = Merseyside localityName = Cheshire organizationName = Flexera commonName = mybeacon.flexera.com [req] distinguished_name = req_distinguished_name default_bits = 2048 req_extensions = v3_req prompt = no [v3_req] basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [alt_names] DNS.1 = mybeacon.flexera.com
openssl genpkey -out key.pem -algorithm RSA -pkeyopt rsa_keygen_bits:2048Alternatively use BeaconMonitorConfigurationTool.exe to generate the key (delete cert.pem after running):
.\BeaconMonitorConfigurationTool.exe generate-cert -ca false
openssl req -new -out server.req -key key.pem -config config.cnf
Copy the server.req to the CA and issue the certificate:
Export the Binary Certificate as server.cer:
openssl x509 -inform der -in server.cer -out cert.pem
You should have the following files when you're done. You need cert.pem and key.pem:
Jul 16, 2020 07:14 AM - edited Jul 16, 2020 07:17 AM