up2date sso certificate

[quanticom]

Hello,

I don't see any procedure in the documentation to up to date the single sign on certificate.

Can you explain me the correct way to change this cert when is expired?

port 11443

Best regards,

Miguel

 

[quanticom]

not enougth

To install the SSO certificate, please, do the following:

1. replace /etc/sso/sso.pem file (this is the default certificate) with the new one.

2. afterwards, please, restart SSO server:

# /etc/init.d/sw-cp-server restart

Now the certificate should be active.

 

[quanticom]

signature is not valid;

there is an error with the new sso cert when you close an user SB session you get that

Internal Sitebuilder error.
File: /usr/local/sitebuilder/include/SB/Actions/SSO/Proxy.php; Line: 142
Message: SSO response signature is not valid; Code: 0

Go back Send report to developers

and some users can't login.

How can I do? can someone tell me the procedure to change the sso cert correctly?

Regards,

Miguel

 

[quanticom]

procedure

[root@ ~]# openssl genrsa -des3 -out sso.key 512
Generating RSA private key, 512 bit long modulus
....++++++++++++
....++++++++++++
e is 65537 (0x10001)
Enter pass phrase for sso.key:
Verifying - Enter pass phrase for sso.key:


[root@ ~]# openssl rsa -in sso.key -out sso.pem
Enter pass phrase for sso.key:
writing RSA key
[root@ ~]#

[root@ ~]# openssl req -new -key sso.pem -out sso.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.

# openssl x509 -req -days 366 -in sso.csr -signkey sso.pem -out sso.crt

now it looks like this:

[root@ ~]# cat /etc/sso/sso.pem


After that I found corresponding sso certificates in Plesk and Sitebuilder:

[root@ ~]# mysql -uadmin -p`cat /etc/psa/.psa.shadow` psa -e "select * from misc where val like '%sso%'"
+---------------------+--------------------------------+
| param | val |
+---------------------+--------------------------------+
| sso_certificate | /usr/local/psa/var/sso.sp.pem |
| sso_idp_api_version | sw:sso:idp:1_0 |
| sso_idp_cert | /usr/local/psa/var/sso.idp.pem |
+---------------------+--------------------------------+

And SB:

[root@ ~]# find /usr/local/sitebuilder/etc/ | grep sso_[s,i] |.pem

/usr/local/sitebuilder/etc/sso_idp_cert.pem
/usr/local/sitebuilder/etc/sso_sp_key.pem

After that I replaced certificate section from /etc/sso/sso.pem into /usr/local/psa/var/sso.idp.pem and /usr/local/sitebuilder/etc/sso_idp_cert.pem files accordingly.

http://www.quanticom.es