Generating a Certificate That is Signed by a Certificate Authority

Generate a certificate and have it signed by a Certificate Authority (CA).

1. From a machine where OpenSSL is installed, open a command prompt and enter the following command: openssl req -days 365 -newkey rsa:<bits> -keyout server-key.pem -out server-request.pem where <bits> is how many bits long you want the private key to be, for example 2048 or 4096.

   The certificate request, server-request.pem, is created.

2. Submit the 'server-request.pem' to the CA to get it signed, and then save the signed certificate you get back from the certificate authority into 'server-cert.pem'
3. Convert the certificate to a PFX file. In the command prompt enter Openssl pkcs12 -export -in server-cert.pem -inkey server-key.pem -out <NewAgentryServer>.pfx where <NewAgentryServer> can be any unique name for the new PFX file.

   An example of a unique PFX file name is NewAgentryServer.pfx.

4. Copy the PFX file into the directory where the Agentry Server instance for the mobile application is located, i.e. C:\SAP\MobilePlatform\Servers\UnwiredServer\<AppName>.
5. From the SAP Control Center expand the Applications node and select the Agentry application. Then perform the following steps:
   1. Click the Configurations tab in the Administration pane and select the check box for ANGEL Front End.
   2. Change authenticationCertificateStore to the name of the new PFX file. Double-click the Value to enter a new name.
   3. Change the authenticationCertificateStorePassword to the password you set in the file. The password is the "PEM pass phrase" that you entered when prompted by OpenSSL in step one.
   4. Click [Apply] to commit the changes to the Agentry Server.
   5. Click [OK] to close the window.
   Note: Any changes made in this step, also need to be applied to the "Server Administration", "Web Server Front End", and "Cluster ANGEL" sections if they exist. All of these sections can use different certificates if desired; there is no requirement that they all use the same PFX file.
6. Install the CA's certificate (and any intermediate certificates required) that you obtain from the certificate authority, in PEM format onto the Agentry client device:
   • Windows and Windows CE –
     1. Copy the file to the device.
     2. Double-click the file to display it, click Install Certificate.
     3. Click Next.
     4. Select Place all certificates in the following store.
     5. Click Browse, select Trusted Root Certificate Authorities, click OK.
     6. Click Next, then Finish.
   • Android – copy the file to the device, open it, and allow it to be imported into the system's trusted certificate store.
   • iOS – create a device configuration profile that contains the certificate using Apple's iPhone Configuration Utility.
     Note: Apple's Web site includes a list of CAs already installed/trusted by the device. If you use one of those, you do not need to install the CA certificate to the device.
7. Restart the Agentry Server and the Agentry Client.
8. Log in to the Agentry Server using the Agentry Client.