Installing a web certificate for a Secure Access (formerly Mobility) console using an internal CA

Note: This guide is written for the new 12.70 version of Secure Access but will work exactly the same with a NetMotion Mobility console. If using Mobility, instead of using the Secure Access Management Tool instead use the Mobility Management Tool.

When submitting the CSR generated by the Secure Access Management tool, to an internal CA, directly through the MMC.exe certificates snap in you will get an error stating "The request contains no certificate template information."

If you are using an internal CA with Web Enrollment configured, the simplest method is to use that feature by following the directions found here: Configuring a CA-Signed Certificate

A video of this can be found here: Mobility Console - Signed Certificate Installation

If you are not using web enrollment, additional steps must be taken to sign the CSR.

These first steps will be done locally on the Secure Access server.

1. Open the Secure Access Management Tool program
2. Click on the third tab, Web Server
3. Click on Server Certificate
   
4. Under the Certificate Request heading, select New
5. Fill in the information about your organization and site for the certificate
   
6. Once the CSR has been generated, click the copy button to copy it to your clipboard
   
7. Paste this text to a notepad file and save it as a .txt file (the filename is irrelevant)
8. Copy this .txt file to your CA or a location accessible from your CA

The next steps are taken locally on your CA

1. Launch Powershell in administrative mode
   1. Run the following command

      certreq -attrib "CertificateTemplate:WebServer"

   2. You'll be prompted for a path to the CSR, select the text file created above
   3. You may be prompted to select your Certificate Authority, make sure to select the CA root certificate
      
   4. Last you'll be prompted where you would like to save the response, choose your file name and save location, success will look similar to the picture below
      
   5. Open a command prompt (not Powershell) in administrative mode
   6. Export the CA's root certificate using the following command, changing the path and filename to whatever you prefer but maintaining the .cer extension

      certutil -"ca.cert" c:\RootCert.cer

      
   7. Copy both files to your Secure Access Server

The following is to be conducted on your Secure Access Server

1. Return to the Secure Access Management Tool and the web server tab
2. If it isn't still open, click on Server Certificate
3. To the right of Root click Import
   
4. Select the root certificate generated in step 6 above
5. If successful, the name of your CA will appear to the right of Root
   
6. Click on Response above and select the response generated in step 1 above
   
7. When completed, the window will look like below
   
8. After clicking close you will be prompted to restart the console. This will not disconnect any Secure Access connections

A note about Firefox

If you are using Firefox as your browser, the certificate will not be trusted. You can allow Firefox to trust this certificate by going to about:config in the Firefox browser

Search for security.enterprise_roots.enabled and change this to true, this will allow you to connect to your console without getting a warning about untrusted certificates