Step 1: Creating private keys and certificates (2024)

Table of Contents

Before you begin Procedure Results What to do next

To improve security, create your own private key and acertificate instead of using the self-signed ones that are availablein BigFix Inventory bydefault. You can use openSSL to create a private key and a certificatesigning request (CSR) that can be transformed into a certificate afterit is signed by a certificate authority (CA).

Before you begin

This procedure is valid for all operating systems thatsupport openSSL.

If you are generating an encrypted privatekey in the pkcs8 format, add the following line to the installation_dir/jre/lib/security/java.security file:

Procedure

Open the command line.
Create a new private key.
```
openssl genrsa -des3 -out key_name.key key_strength -sha256
```
Forexample, openssl genrsa -des3 -out private_key.key 2048 -sha256
Where:
-des3
Enables password for the private key. This is an optional parameter.You can also enable password for an existing private key by usingthe following command:
openssl rsa -des3 -in path_to_private_key.key-out key_name.key
key_name
File name for your new private key.
key_strength
Key strength, measured in bits. The maximum value that you canuse for BigFix Inventory is2048 bits.
Create a certificate signing request (CSR). The requestis associated with your private key, and is later transformed intoa certificate.
```
openssl req -new -key path_to_private_key.key -out csr_name.csr
```
Forexample, openssl req -new -key private_key.key -out CSR.csr
Where:
path_to_private_key
Path to your private key.
csr_name
File name for your certificate signing request (CSR).
After you run the command, you are asked toprovide information that helps your users to identify your certificateand ensure that it can be trusted. The following excerpt from thecommand line is filled in with sample information:
```
Country Name (2 letter code) [XX]: USState or Province Name (full name) []: New YorkLocality Name (eg, city) [Default City]: New YorkOrganization Name (eg, company) [Default Company Ltd]: HCL (eg, section) []: SoftwareCommon Name (eg, your name or your server's hostname) []: inventory.bigfix.comEmail Address []: inventory@bigfix.com
```

Results

After completing these steps, two files are created, your private key(.key) and the certificate signing request (.csr).

What to do next

Sign the request to transform it into the certificate. For information about how to createa private certificate authority (CA) to sign the request, see Signing certificates.