Configuring the SSL Certificate

Install an X.509 certificate to ensure the security of encrypted SSL communication between Sybase Control Center and browser clients.

When Sybase Control Center starts for the first time, it generates a self-signed X.509 Secure Sockets Layer (SSL) certificate for the host that it is running on. Because self-signed certificates are not issued by a trusted certificate authority, most browsers show an error when they try to connect to Sybase Control Center using the self-signed certificate.

To use the self-signed certificate, you can override the browser error or add a security exception. It is generally safe to accept the self-signed certificate if you know that the server is on a protected machine. However, your browser might still display a certificate error.

To avoid certificate errors, you can install a permanent SSL certificate from a certificate authority. Sybase recommends that you install a certificate signed by a certificate authority before using Sybase Control Center in your production network. Obtain a certificate for each machine on which a Sybase Control Center server is installed.

The following is an overview of the procedure for purchasing and installing an SSL certificate from a certificate authority. For full details, see http://docs.codehaus.org/display/JETTY/How+to+configure+SSL.

To obtain an SSL certificate from a known certificate authority (such as VeriSign, Inc. or Thawte, Inc.), generate a certificate signing request (CSR) and send it to the certificate authority. Use one of these commands to generate the CSR:
Windows:
```
keytool -certreq -alias jetty -keystore 
%SYBASE_UA%\services\EmbeddedWebContainer\keystore -file scc_jetty.csr
```
UNIX:
```
keytool -certreq -alias jetty -keystore 
$SYBASE_UA/services/EmbeddedWebContainer/keystore -file scc_jetty.csr
```
Follow the instructions provided by the certificate authority to import the signed certificate into the Sybase Control Center keystore and, if necessary, to install the certificate authority's trusted certificate in the “truststore,” cacerts. Typically the command to import the signed certificate is:
Windows:
```
keytool -keystore %SYBASE_UA%\services\EmbeddedWebContainer\keystore 
-import -alias jetty -file scc_jetty.crt -trustcacerts 
```
UNIX:
```
keytool -keystore $SYBASE_UA/services/EmbeddedWebContainer/keystore 
-import -alias jetty -file scc_jetty.crt -trustcacerts 
```
The keystore password is changeit.