Renewing SSL Certificates for Forcepoint Software

Renewing SSL Certificates for Forcepoint Software

Summary
Commands for generating a new CSR from an expiring certificate.
Notes and Warnings

Note This command can be used to create a new CSR for any Forcepoint product.
 

Problem
The Forcepoint Security Manager and Content Gateway both use a Certificate Authority-signed SSL certificate.
 
The certificates for these products are expiring soon. How do I renew these certificates with the same previously used Certificate Authority?
Solution

You need the following items to renew Forcepoint product certificates:

  1. The Public Certificate that is expiring.
  2. The Private Key for the Public Certificate.
  3. The password for the Private Key.

The following command reads the private key (private.key) and existing certificate (oldcert.pem). It generates a new certificate request (newcsr.csr) using the information in the old certificate.

  • openssl x509 -x509toreq -signkey private.key -out newcsr.csr -in oldcert.pem

For signing, send the new CSR to the Certificate Authority. 
 
To import the signed certificate into your Forcepoint product, refer to Forcepoint Knowledge Base Articles.


When updating the EIP Infrastructure certificate on the Forcepoint Management Server, use the steps below.

  1. Stop Websense TRITON Web Server service.
  2. Backup expired or expiring certificates at  \Websense\EIP Infra\apache\conf\keystore\httpd\HTTPD-SERVER.CER
  3. Replace existing HTTPD-SERVER.CER with signed certificate from this KB
  4. Start Websense TRITON Web Server service.