The QoreStor Secure Connect feature requires custom certificates on both the client and QoreStor server machine.

NOTE: The certificates on both the client machine and QoreStor server must be from the same certificate authority.

Adding a Secure Connect certificate - Windows Client

1. Prepare custom certificates chain and install them to the certificate store using the Microsoft Management Console (MMC) Certificates snap-in.
   1. Install the Root certificate to Trusted Root Certification Authorities.
   2. If necessary, install the Intermediate certificate to Intermediate Certification Authorities.
   3. Install the Server certificate to Personal.
2. In the client installation directory, open the sc_client.properties file with a text editor.
3. Edit the entries below:
   • openSSL.client.caConfig -  The path to the file of the trusted root certificate or directory containing the trusted root certificates chain. For specifying directory path, be sure that directory contains certificates in the PEM format and symbolic links to the certificate files, created by the c_rehash utility.
   • openSSL.client.certificateFile - The path to the file containing the server's or client's certificate in PEM format.
   • openSSL.client.privateKeyFile - The path to the file containing the private key for the certificate in PEM format.

     Example in case there is the chain of 3 certificates (root, intermediate, server), private key and they are located in the same directory as sc_client.dll:

     • openSSL.client.caConfig = ${application.configDir}
     • openSSL.client.certificateFile = ${application.configDir}server-certificate-name.pem
     • openSSL.client.privateKeyFile = ${application.configDir}privat-key-name.key

     Example in case there is the chain of 2 certificates (root, server), private key and they are located at C:\certificates:

     • openSSL.client.caConfig = C:\certificates\root-certificate-name.pem
     • openSSL.client.certificateFile = C:\certificates\server-certificate-name.pem
     • openSSL.client.privateKeyFile = C:\certificates\privat-key-name.key
4. Make c_rehash for the certificates:
   1. Download perl from https://www.activestate.com/ActivePerl.
   2. Download the perl script c_rehash, stored inside OpenSSL (https://wiki.openssl.org/index.php/Binaries)
   3. Set the new openssl environment variable with the path to openssl.
   4. Run the command prompt.
   5. Use perl.exe with path_to_the_c_rehash and path_to_the_cert_dir arguments (e.g. perl.exe C:\<path to the c_rehash> C:\<path to the certificates directory>)
5. When Secure Connect is used with any DMA - restart DMA services.

NOTE: If certificate validation fails, the connection between client and server will fail back to a normal connection.

Adding a Secure Connect certificate - Linux Client and QoreStor server

1. Prepare custom certificates chain
2. Place the certificate to be trusted (in PEM format) in /etc/pki/ca-trust/source/anchors/ and run sudo update-ca-trust at the prompt.

   If the certificate is in OpenSSL’s extended BEGIN TRUSTED CERTIFICATE format, place it in /etc/pki/ca-trust/source and run sudo update-ca-trust.

3. Make c_rehash for the certificates:
   1. Install the openssl-perl package.
   2. Run c_rehash <path-to-the-folder-with-certificates>.
4. In the client installation directory, open the sc_client.properties file with a text editor.
5. Edit the entries below:
   1. openSSL.client.caConfig - The path to the file of the trusted root certificate or directory containing the trusted root certificates chain. For specifying directory path, be sure that directory contains certificates in the PEM format and symbolic links to the certificate files, created by the c_rehash utility.
   2. openSSL.client.certificateFile - The path to the file containing the server's or client's certificate in PEM format.
   3. openSSL.client.privateKeyFile - The path to the file containing the private key for the certificate in PEM format.

      Example in case there is the chain of 3 certificates (root, intermediate, server), private key and they are located in the same directory with sc_client.so, server side:

      • openSSL.server.caConfig = ${application.configDir}
      • openSSL.server.certificateFile = ${application.configDir}server-certificate-name.pem
      • openSSL.server.privateKeyFile = ${application.configDir}privat-key-name.key

      Example in case there is the chain of 2 certificates (root, server), private key and they are located at /usr/certificates on the client machine:

      • openSSL.client.caConfig = /usr/certificates/root-certificate-name.pem
      • openSSL.client.certificateFile = /usr/certificates/server-certificate-name.pem
      • openSSL.client.privateKeyFile = /usr/certificates/privat-key-name.key
6. When Secure Connect is used with any DMA - restart DMA services.

NOTE: If certificate validation fails, the connection between client and server will fail back to a normal connection.