TLS/SSL certificates

You must configure the TLS/SSL Certificates for Unified Access Gateway appliances. TLS/SSL is required for client connections to Unified Access Gateway appliances. Client-facing Unified Access Gateway appliances and intermediate servers that terminate TLS/SSL connections require TLS/SSL server certificates.

TLS/SSL server certificates are signed by a Certificate Authority (CA). A CA is a trusted entity that guarantees the identity of the certificate and its creator. When a certificate is signed by a trusted CA, users no longer receive messages asking them to verify the certificate, and thin client devices can connect without requiring additional configuration.

Note: Configuring the TLS/SSL certificates for the Unified Access Gateway appliance applies to Horizon and Web Reverse Proxy only.

A default TLS/SSL server certificate is generated when you deploy a Unified Access Gateway appliance. For production environments, it is recommended to replace the default certificate as soon as possible. The default certificate is not signed by a trusted CA. Use the default certificate only in a non-production environment.

It is recommended to use an RSA key-based certificate for TLS server. Certificate and the private key can be provided as PKCS12/PFX keystore or as a separate private key and certificate chain files in PEM format.

To convert a PKCS12/PFX to certificate chain file in PEM format, run the following openssl command:

openssl pkcs12 -in mycaservercert.pfx -nokeys -out mycaservercert.pem

To convert a PKCS12/PFX to private key file in PEM format, run the following openssl command:

openssl pkcs12 -in mycaservercert.pfx -nodes -nocerts -out mycaservercertkey.pem

When providing the certificate and key in PEM format, the private key must be in PKCS1 format. To convert the private key from PKCS8 to PKCS1 (from BEGIN PRIVATE KEY format to BEGIN RSA PRIVATE KEY format), run the following openssl command:

openssl rsa -in mycaservercertkey.pem -check -out mycaservercertkeyrsa.pem

Modify the admin and TLS certificate

When deploying a Unified Access Gateway (UAG) appliance, the administrator can configure the certificate for admin and internet interface by providing appropriate parameters in the INI settings. The configured certificates will appear in the Admin UI > TLS Server Certificate Settings. If no certificate is specified during deployment, a self-signed certificate is automatically generated for both admin and internet interfaces.

The private key and certificate chain associated with these certificates can be replaced.

To replace the private key and certificate:

1. In the Configure Manually section of the UAG Admin console, click Select.
2. In the Advanced Settings, select the TLS Server Certificate Settings gearbox icon. A list of already configured certificates is displayed.
3. Click Edit against the certificate to be replaced.
4. Select the Certificate Type from the drop-down list.
5. For PEM, select the Private Key and Certificate Chain in PEM format.
6. For PFX, enter the following details.
   • Click Select to Upload PFX certificate.
   • Enter the PFX Password.
   • If there are multiple certificates in the uploaded PFX, enter the Alias to indicate which certificate to use.
7. Click Save.

Add multiple TLS certificates/Internet interface

1. In the Configure Manually section of the UAG Admin console, click Select.
2. In the Advanced Settings, select the TLS Server Certificate Settings gearbox icon.
3. Click the Add Internet Certificate button. Internet TLS Server Certificate Settings window is displayed.

4. Click Save.

INI sample and guidelines

Use the following section in the INI settings to configure multiple TLS certificates during deployment.

[SSLCert1]
identifier=cert1
defaultSSL=true
pemPrivKey=resources\\test-key1.pem
pemCerts=resources\\test-chain1.pem

[SSLCert2]
identifier=cert2
defaultSSL=false
pemPrivKey=resources\\test-key2.pem
pemCerts=resources\\test-chain2.pem

[SSLCert3]
identifier=cert3
defaultSSL=false
pfxCerts=resources\\test-cert1.pem
pfxCertAlias=

Use these guidelines to avoid configuration and deployment issues with PowerShell:

• When adding multiple certificates, they must be added in sequential order. For example, if you are adding three certificates, the sections should appear as [SSLCert1], [SSLCert2], [SSLCert3], and so on. Skipping or misordering sections can lead to configuration errors.
• Each certificate section must include an identifier parameter for PowerShell deployments to manage individual certificates.
• One certificate must be set as the default by specifying defaultSSL=true for that certificate.
• More than one certificate cannot be set as the default.

Replace an existing "Default" TLS certificates/Internet interface

1. On the TLS Server Certificate Settings window, click Edit on the certificate you want to mark as the "Default".
2. Turn on the Mark as default toggle.
3. Click Save.