Using uagcertutil command

Use this command to generate a new private key and Certificate Signing Request (CSR), upload, list, and remove the TLS certificates uploaded within Unified Access Gateway.

Procedure

Generate CSR and Private Key

You can use this CSR to get a CA signed certificate and configure the certificate and private key for admin and/or internet facing TLS interfaces.

1. Log in to Unified Access Gateway console as root or sudo privileged user.

2. Open the default configuration file. Alternatively, you can specify a different file location.

   vi /opt/omnissa/certutil/uagcertutil.conf
   OR
   vi /opt/omnissa/certutil/*example1*.conf
   

   Note: A backup configuration file is available at /opt/omnissa/certutil/uagcertutil.example.conf.

3. Update the file to specify the configurations to be used by Unified Access Gateway certificate utility. For example, you can specify the size of the key, the signature algorithm to be used for signing the CSR, the private key filename, and so on.

4. Run the following command to generate a private key and a CSR.

   Default configuration file

   uagcertutil --newcsr
   

   Different configuration file

   uagcertutil --newcsr --config /opt/omnissa/certutil/*example1*.conf
   

   A new private key is generated in the default path and a CSR is successfully generated in the file path specified in the config file.

5. Copy the generated CSR to an external CA and get a signed certificate chain.

6. Copy the signed certificate back to Unified Access Gateway. Update the configuration file with the new CA-signed certificate path. Ensure that you are pointing to the same private key filename generated in step 4.

7. Update the target (with admin and/or esmanager) in the config file and run the following command to configure the admin and/or esmanager TLS servers with the generated certificate.

   uagcertutil --bind
   

Results

The new TLS certificate is successfully been updated for admin and/or internet interface.

View certificate details or remove existing certificate

1. Log in to Unified Access Gateway console as root or sudo privileged user.

2. Run the following command.