Uploading a Single server identity certificate

About this task

Use this procedure to upload an identity certificate for the Primary EPM and coresident MPP through the Experience Portal web admin interface without re-installing the Experience Portal software. The identity certificate for the Primary EPM and coresident MPP is issued by an external Certificate Authority.

Before you begin

Ensure that the Single EP server is not processing any multi-channel messages such as Emails, SMS, or HTML.
Ensure that the MPP is not processing any traffic.
If a managed application is installed, you might need to perform additional steps before and after the identity certificate is updated. For more information, see the documentation of the managed application.
Ensure that you complete the Pre-requisites for importing custom identity certificates.
Ensure that the Primary EPM is in the Running state.
Ensure that the MPP server is in either the Stopped or Running state.

Important:

The uploaded certificate file must be in PKCS#12 format. This includes an identity certificate, CA public certificates and the corresponding private key. This certificate is encrypted and requires a password. The password is chosen during the creation of the PKCS#12 file by the designated CA.
If Extended Key Usage is specified in the X509.V3 certificate extension, specify Server Authentication which is also called serverAuth, and Client Authentication which is also called clientAuth, for the usage.
The certificate must have a valid Common Name that represents the EP server host name.
If the Subject Alternate Name is specified in the X509 V3 certificate extension, the certificate must contain valid DNS and IP Address entries that are associated with the EP server host name.

Procedure

Log on to the EPM web interface.
Click Security > Certificates.
Click the EPM Identity Certificates tab.
On the EPM Identity Certificates tab, click Upload.
On the Upload Identity Certificate page, do the following:
1. In the Server Name field, click the name of the Primary EPM server.
2. In the Security Certificate File field, click Choose File and choose the PKCS#12 formatted security file for the Primary EPM server.
3. In the Password field, enter the password of the chosen PKCS#12 formatted security file.
4. Click Continue.

On the Save Identity Certificate page, do the following:

Review the warning that the Primary EPM services will be automatically restarted to install the identity certificate.

Note:

The coresident MPP services will also automatically be restarted if the MPP is in the Running state.

If the coresident MPP is in the Stopped state before this procedure, it will remain in the Stopped state after the new identity certificate is installed. The MPP will need to be manually started through System Management > MPP Manager to apply the new identity certificate on the MPP.

Review the identity certificate text that is displayed to ensure it is the correct certificate to install for the Primary EPM server and the coresident MPP.

Click Save to install the identity certificate on the Primary EPM and coresident MPP.

	Note:
	The Primary EPM services will automatically restart. Therefore, the Experience Portal web admin site may not render pages correctly until the restart is completed. The user will then be asked to login again.

Next Steps

If you have completed the Pre-requisites for importing custom identity certificates , do the following to accept the new certificate on the MPP:

Log in to the console as a root user.
Navigate to the $AVAYA_HOME/Support/VP-Tools directory.
Run the ./setup_vpms.php <Primary EPM> command, where <Primary EPM> is the IP address or hostname of the Primary EPM.
Type Y, and press Enter to accept the new certificate.

For NTP service, type Y, and press Enter to use the Primary EPM.