Some certificate authorities require a certificate signing request (CSR) to generate the SSL certificate. You can generate a CSR using the Threat Manager self-signed certificate, or by manually creating one. For example, if you want to set a custom expiration date or other parameters.

Both methods end with the same steps: Transferring the CSR to the certificate authority and installing the signed certificate.

For TLS protocol version configuration, refer to (On-premises) TLS/SSL settings in the Advanced configuration section of iManage Threat Manager Administration Help.

In this section:

Certificate information fields

Both CSR methods prompt you to enter certificate information. The fields are listed below. The prompts may not appear in the order shown here.

Required:

  • Common Name: The fully-qualified domain name you're securing. The Common Name (CN) is the redirect/cluster alias of iManage Threat Manager—for example, TM.CustomerDomain.xyz. You can also specify Subject Alternative Names (SANs) linking back to the iManage Threat Manager hostname—for example, https://imanage-threat-manager.CustomerDomain.com. For wildcard certificates, add an asterisk (*) to the left of the common name where you want the wildcard. You must enter a fully qualified domain name for the certificate to be valid.

Two files are generated when the CSR is complete. The file extensions vary by method; refer to the relevant task for details.

Optional (press Enter to skip any field):

  • Country Name: The two-letter International Organization for Standardization (ISO) format country code for where your organization is locally registered.

  • State or Province Name: Name of the state or province where your organization is located. Don't abbreviate.

  • Locality Name: Name of the city where your organization is registered. Don't abbreviate.

  • Organization Name: The legally-registered name for your business. If you're enrolling as an individual, enter the certificate requestor's name.

  • Organizational Unit Name: If applicable, enter the DBA (doing business as) name.

Task: Use the Threat Manager self-signed certificate as a CSR

Use this procedure to generate a Threat Manager self-signed certificate and use it as your CSR.

If you selected Generate a self-signed certificate when provisioning your iManage Threat Manager instance, the self-signed certificate already exists. In that case, skip to step 6.

  1. From a terminal window, bring down the containers and remove the Docker stack: docker stack down Threat Managerstack

  2. Connect to the appliance and go to the home folder, which is typically located at /home/Threat Manageradmin.

  3. Run the following script: ./setup.sh

  4. When asked if you want to run Threat Manager in SSL (HTTPS) mode, enter Y.

  5. When asked if you want to generate a self-signed certificate, enter Y.

  6. Enter the certificate information when prompted. Refer to Certificate information fields for field descriptions. Two files are generated: one with the .pem extension and one with the .key extension.

  7. Skip the option to change passwords by entering n at the relevant prompts.

Next, transfer the .pem file to the certificate authority. Refer to Task: Set up FileZilla for file transfer and Task: Upload the CSR to the certificate authority.

Task: Manually generate a CSR

Use this procedure to manually generate a certificate signing request using OpenSSL.

  1. Generate a certificate signing request by running the following command, replacing <certname> with the name you want to use for the output files: openssl req -new -newkey rsa:2048 -nodes -keyout <certname>.key -out <certname>.csr Two files are generated:

    • Private key file (<certname>.key): Used to generate the CSR and later to secure and verify connections using the certificate.

    • Certificate signing request file (<certname>.csr): Used to order your SSL certificate and later to encrypt messages that only its corresponding private key can decrypt.

  2. Enter the certificate information when prompted. Refer to Certificate information fields for field descriptions.

Next, transfer the .csr file to the certificate authority. Refer to Task: Set up FileZilla for file transfer and Task: Upload the CSR to the certificate authority.

Task: Set up FileZilla for file transfer

Use a secure file transfer program such as FileZilla to copy files between your local Windows or macOS workstation and the iManage Threat Manager appliance.

  1. Download and install Filezilla (https://filezilla-project.org/download.php?type=client).

  2. In FileZilla, configure permissions to enable transfer between Windows and the iManage Threat Manager appliance. Refer to the FileZilla documentation (https://wiki.filezilla-project.org/Using) for additional details.

You can now use FileZilla to transfer files from or to the Threat Manager appliance.

Task: Upload the CSR to the certificate authority

Follow this procedure to upload your CSR to the certificate authority and retrieve the signed certificate:

  1. Use FileZilla to transfer the CSR file or self-signed certificate file (.csr or .pem) from the appliance to your workstation. (For download and set up instructions, refer to Task: Set up FileZilla for file transfer.)

  2. Upload the CSR to the certificate authority. If you have an option to specify the certificate pair format, select PEM (Base64) format. Otherwise, because encrypted private keys aren't supported and passphrases must be removed, download as an unencrypted key pair in DER, P7B/PKCS#7, PFX/P12/PKCS#12 file format and then convert these into PEM (Base64) format before installation.

When you're in possession of the signed certificate, proceed to Task: Install the signed certificate.

Task: Install the signed certificate

Following this procedure installs the signed certificate on the Threat Manager appliance. Complete this procedure after you have received the signed certificate from the certificate authority.

  1. Copy the certificate and corresponding private key into a location that is available to setup.sh — for example, the home folder, which is typically located at /home/Threat Manageradmin.

  2. From a terminal window, bring down the containers and remove the Docker stack: docker stack down Threat Managerstack

  3. Run the following command: ./setup.sh

  4. Enter the information as prompted, making sure to reconfigure settings by selecting y at that prompt.

  5. Restart the containers by running the following command: docker stack deploy --compose-file ./docker-compose_v10.yaml --with-registry-auth Threat Managerstack