Replacing the pre-configured TLS certificate with your own certificate

The automated installation package of the eperi sEcure Platform is shipped with a self-signed TLS certificate. It is used to secure the data transfer between the eperi sEcure Platform server and the Admin Console with TLS. We recommend to replace the shipped certificate with your own certificate right after the installation of the eperi sEcure Platform.

1. Upload your keystore file to the target server.
2. Connect to the target server using your preferred ssh tool and log in.
3. Copy your keystore file to a suitable location, for example:

   sudo cp /home/admin/sslcerts/mycompany_keystore.p12 /etc/eperi/gateway/tomcat

4. Edit the Tomcat server configuration file as follows:
   1. Open the file server.xml in the editor:

      sudo vi /etc/eperi/gateway/tomcat/server.xml

   2. Within the file server.xml, search for the following line:

      keystoreFile="/etc/eperi/gateway/tomcat/preconfigured_keystore.p12" keystorePass="changeme" keystoreType="PKCS12"

   3. Set your own keystore by replacing the value of the attribute keystoreFile by the path of your own PKCS#12 keystore and by replacing the value of the attribute keystorePass with the password of your keystore. For example:

      keystoreFile="/etc/eperi/gateway/tomcat/mycompany_keystore.p12" keystorePass="Z2a0fw034%&" keystoreType="PKCS12"

   4. Save your changes and exit the server.xml.
5. Restart eperi sEcure Platform as follows:

   sudo systemctl restart eperi-gateway

6. Make sure to allow TCP network traffic on port 8443 in the server's firewall. This port is used to access the eperi sEcure Admin Console.