How to create signed SSL certificates for the Web Engine or Sage MAS 200 Application Server

The following contains information and instructions on generating a Certificate Signing Request (CSR) which you are required to send to a Certificate Authority (CA) to obtain an SSL certificate for your server(s).

Get to a command line prompt in the HOME directory of your MAS installation and enter the command:
> cd \pvx (ie. change to the directory where openssl.exe now resides)

1. Generate the Private Key
   The first step will be to generate a 1024 bit RSA Private Key for Certificate use.
   This command requires no interaction.
   > openssl genrsa -out privkey.pem 1024
   
   It is highly recommended that you back up this key to several locations. If lost the SSL will no longer function and you may have difficulties renewing your SSL Certificate in future. IMPORTANT! Never share your Private Key with anyone - doing so will allow your SSL-secured TCP/IP network traffic to be intercepted and decrypted!
   
2. Generate the CSR
   This will generate the certificate CSR. Enter the following command:
   > openssl req -new -key privkey.pem -out Pvx.csr -config openssl.conf
   
   You will be now be prompted to enter information that will be incorporated into your certificate request.
   
   What you about to enter is what is called a Distinguished Name (DN). There are quite a few fields but you can leave some blank; for some fields there is a default value. If you enter '.' the field will be left blank. Please note, entries below are examples only; please enter your own information and not those shown.

   Country Name (2-letter code)	[]:CA
   State or Province Name (full name)	[]:Ontario
   Locality Name (e.g. City)	[]:Markham
   Organization Name (e.g. Company)	[]:Sage Software Canada Ltd.
   Organizational Unit Name (e.g. Section)	[]:ProvideX
   Common Name (e.g. Your Name)	[]:*.pvx.com
   Email Address	[]:[email protected]
   Please enter the following 'extra' attributes to be sent with your certificate request:
   A Challenge Password	[]:
   An Optional Company Name	[]:

   
   Note:Common Name (CN) is not 'your name', it is the name of your server. For example, if you are creating a certificate for use only on your webserver, enter as the Common Name: www.mydomain.com where mydomain.com is your domain name, e.g. www.pvx.com.
   
   The example above shows '*.pvx.com' which is a wildcard certificate. The certificate would be valid on any machine in the pvx.com domain. This is a special certificate which requires you to place your order with a CA (Certificate Authority) for a wildcard certificate. Since a wildcard certificate may be used on any machine in your domain, you may have to purchase "Rights to Use" from the CA for the number of different servers you wish to use the certificate on.
   
   A wildcard certificate is used most often when a single machine has several different names with which to provide different services. For example at our office, a machine named 'inet.pvx.com' provides web, ftp and mail services. These services are provided by using the correct name such as www.pvx.com, ftp.pvx.com or mail.pvx.com. To use one certificate on this server which has three different names, a wildcard certificate is required.
   
3. You will now have 2 text files in your directory:
   
   privkey.pem
   This is your Private key
   
   Pvx.csr
   This is the "Certificate Signing Request" and is the file you send to a CA (Certificate Authority) when you want to purchase an SSL Certificate from them. Do not send your Private Key file to the CA; only send the CSR.