Uploading a Primary EPM server identity certificate

About this task

Use this procedure to upload an identity certificate for the Primary EPM through the Experience Portal web admin interface without re-installing the Experience Portal software. The identity certificate for the Primary EPM is issued by an external Certificate Authority.

Before you begin

Ensure that the Primary EPM server is not processing any multi-channel messages such as Emails, SMS, or HTML.
If a managed application is installed, you might need to perform additional steps before and after the identity certificate is updated. For more information, see the documentation of the managed application.
Ensure that you complete the Pre-requisites for importing custom identity certificates.
Ensure that the Primary EPM is in the Running state.

Important:

The uploaded certificate file must be in the PKCS12 format. This includes an identity certificate, CA public certificates and the corresponding private key. This certificate is encrypted and requires a password. The password is chosen during the creation of the PKCS#12 file by the designated CA.
If Extended Key Usage is specified in the X509.V3 certificate extension, specify Server Authentication which is also called serverAuth, and Client Authentication which is also called clientAuth, for the usage.
The certificate must have a valid Common Name that represents the EP server host name.
If the Subject Alternate Name is specified in the X509 V3 certificate extension, the certificate must contain valid DNS and IP Address entries that are associated with the EP server host name.

Procedure

Log on to the EPM web interface.
Click Security > Certificates.
Click the EPM Identity Certificates tab.
On the EPM Identity Certificates tab, click Upload.
On the Upload Identity Certificate page, do the following:
1. In the Server Name field, click the name of the Primary EPM server.
2. In the Security Certificate File field, click Choose File and choose the PKCS#12 formatted security file for the Primary EPM server.
3. In the Password field, enter the password of the chosen PKCS#12 formatted security file.
4. Click Continue.

On the Save Identity Certificate page, do the following:

Review the warning that the Primary EPM services will be automatically restarted to install the identity certificate.
Review the identity certificate text that is displayed to ensure it is the correct certificate to install for the Primary EPM server.

Click Save to install the identity certificate on the Primary EPM.

	Note:
	The Primary EPM services will automatically restart. Therefore, the Experience Portal web admin site may not render pages correctly until the restart is completed. The user will then be asked to login again.

Next Steps

If you have not completed the Pre-requisites for importing custom identity certificates , do the following to accept and trust the new Primary EPM identity certificate on all Auxiliary EPMs and MPPs:

On each auxiliary EPM and MPP, log in to the console as a root user.
Navigate to the $AVAYA_HOME/Support/VP-Tools directory.
Run the ./setup_vpms.php <Primary EPM> command, where <Primary EPM> is the IP address or hostname of the Primary EPM.
Type Y, and press Enter to accept the new certificate.

For NTP service, type Y, and press Enter to use the Primary EPM.