Securing an Authentication Manager Connection

Creating a Certificate on a Windows Server

On the Server that the Authentication Manager is installed, open the Command Prompt and go to the following directory:
```
C:\Program Files\Help Systems\Access Authenticator\jvm\bin
```
Enter the following command to generate the key using the keytool:
```
keytool -keysize 2048 -genkey -alias FullDomainName -keyalg RSA -keystore authmgr.keystore
```
After creating a password, you’ll be prompted for your organization's information. When asked for your first and last name, specify the domain name of the server that users will enter in order for their Authentication Manager name to help ensure that their certificates are valid when connecting to the server. We recommend not using an IP Address.
After you have filled in the requested fields, press Enter. The resulting authmgr.keystore file is located in your working directory (C:\Program Files\Help Systems\Access Authenticator\jvm\bin).
Export the certification from the keystore you just created so that you can import it into your Insite server’s cacerts file in a later step.
```
keytool -export -alias FullDomainName -file Domain.crt -keystore authmgr.keystore
```
Copy the .crt file to the Insite Server system.

Enabling the Certificate

Stop the Access Authentication Manager service. On Windows, run services.msc to open the Services Manager. Right-click Access Authenticator Manager and choose Stop.
Still on the Authentication Manager sever, open the Command Prompt and go to the following directory:
```
C:\Program Files\Help Systems\Access Authenticator\AuthenticationManager\conf
```
Copy the authmgr.keystore file created into this directory.
Open and edit the server.xml file as follows. This file’s location depends on the directory where the portal server is installed (see step 2).
NOTE: You can edit the server.xml file with any text editor. Be sure to create a backup a copy of the original file before editing. If you are not familiar with the XML format, we recommend using an XML-aware editor such as XML Notepad or Notepad++.

Comment out the code block for protocol="HTTP/1.1"

Connector SSLEnabled="false" compression="force" connectionTimeout="20000" port="3040" protocol="HTTP/1.1" scheme="http" secure="false"/

Add in code block :

Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
SSLEnabled="true" scheme="https" secure="true"
keystoreFile="conf/authmgr.keystore" keystorePass="password used when creating the keystore"
sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2"
ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA" /

Import the Certificate Authority into Insite

On the Insite server, stop the HelpSystems Insite service.
1. On Windows, run services.msc to open the Services Manager.
2. Right-click Access HelpSystems Insite Server and choose Stop.

Open a command prompt in java 'bin' folder:

c:\Program Files (x86)\Help Systems\HelpSystems Insite\jvm\bin

Run the import command:
```
keytool -import -alias Server Alias -file Certificate Path -keystore Keystore Path
```
EXAMPLE:
keytool -import -alias Server2012RAuth.domain.com -file c:\helpsys\Server2012RAuth.crt -keystore "C:\Program Files (x86)\Help Systems\HelpSystems Insite\jvm\lib\security\cacerts
Enter the keystore password, "changeit" by default.
Type yes and press Enter.
Restart the Insite server

Securing an Authentication Manager Connection on Windows