Create a certificate signing request for a custom intermediate certificate authority

Summary

This article describes how to create a certificate-signing request (CSR) for a custom intermediate certificate authority (for HTTPS Inspection) or server certificate.

With SWG, typically, there are two types of SSL certificates that are needed and that you might want to have officially signed:

• Intermediate certificate authorities
• Server certificates

This article describes how to create a CSR for both types of certificates. This CSR is signed by a third-party certificate authority (CA), such as your internally used PKI.

You might want to use a custom intermediate certificate authority for HTTPS inspection instead of the default self-signed one that's shipped with the product. When using HTTPS inspection, SWG acts as a man-in-the-middle for the HTTPS connection and replaces the certificate provided to the user. The CA then signs the certificate. 
The server certificate can be used to secure access to SWG. For example, when accessing the user interface, intercepting a connection in a reverse proxy environment, or securing the connection to the ICAP server.

Solution

To configure a custom intermediate CA or server certificate, you need the private key and the certificate. The following steps create the private key and CSR. The CSR is sent to the signing CA. After it's signed, the signing CA sends the certificate.

The following steps can be followed on every device running a recent version of the OpenSSL toolkit. We recommend connecting to a system running SWG via SSH or command line, and running the steps. The example steps outlined below were performed on such a device. These steps might differ on other devices.

1. Log on to SWG (or another device providing OpenSSL toolkit) using SSH or a command-line session. 
2. Create a temporary directory:
   1. Type mkdir -p ~/new_certificate/private ~/new_certificate/csr and press Enter.
   2. Type cd ~/new_certificate and press Enter.
3. Set permissions so other users can't read sensitive data: Type chmod 700 private and press Enter.
4. Create a new private key: Type openssl genrsa -aes256 -out private/new_certificate.key 4096 and press Enter.

5. Create a CSR:
   1. Download one of the attached openssl configuration files (.zip) and extract it.
      • To create an intermediate CA, download openssl_intermediate.zip.
      • If you want to create a server certificate, download openssl_server.zip.
   2. Extract the downloaded .zip file.
   3. Place openssl.cnf from the extracted archive to the previously created working directory (~/new_certificate).
      This action can be performed via WinSCP for example.

   4. OPTIONAL STEP:
      If you must create a server certificate for multiple names (How to use the "subject alternative names" extension

      1. Open openssl.cnf in an editor of your choice.
      2. Remove the comment (#) from the line starting with #subjectAltName.
      3. At the bottom of the file, in the [alt_names] section, add all the needed subject alternative names.

5. Type openssl req -new -nodes -config openssl.cnf -key private/new_certificate.key -out csr/new_certificate.csr -sha512 and press Enter. 
6. OpenSSL now asks for details to configure the meta information for the common name configuration as below:
   • For Intermediate certificate authority: Pick a name that's visible as the CA that signed the certificate. You can pick any name that suits your needs.
   • For Server certificate: When you create a server certificate, the common name must match the host name of the service that the certificate is going to secure.
     For example, if you access the user interface of your SWG using https://mwg-admin.mycorp.tld:4712, the common name must be mwg-admin.mycorp.tld
7. You're prompted for the private keys passphrase that you set up earlier. Enter the passphrase.
8. Get the private key and CSR. When working on an SWG installation, you can use WinSCP to get the files. They're stored in your home directory. For example:
   • /home/my_user/new_certificate/private/new_certificate.key
   • /root/new_certificate/private/new_certificate.key
   • /home/my_user/new_certificate/csr/new_certificate.csr
   • /root/new_certificate/csr/new_certificate.csr

6. Have the CSR signed:
   After you've obtained the two files, you must have the CSR signed by your third-party CA.
   How the CSR is signed depends on the third-party vendor or your local PKI administrators. The usual process is to send the CSR file and have it signed, which means you get a signed certificate as a response. Import the new certificate into SWG:

7. Import the new certificate into SWG:
   After you receive the signed certificate back from the signing instance, import the certificate and the private key to SWG.
   For information about this process, see the Skyhigh Web Gateway Product Guide for your release.