Tarantella Administration Guide > Security > Sharing web server and Tarantella server certificates

Sharing web server and Tarantella server certificates

How you share an X.509 certificate between a web server and Tarantella, depends on whether or not you are using the Tarantella Web Server.

Sharing a Tarantella server certificate with the Tarantella Web Server

The configuration file (install_dir/webserver/apache/1.3.27/conf/httpd.conf) for the Tarantella Web Server is pre-configured to use the same certificates as the Tarantella server. These are installed in the install_dir/var/tsp directory. So to share a Tarantella server certificate with the Tarantella Web Server:

1. Obtain and install an X.509 certificate for use with the Tarantella Security Pack.
2. Enable secure (HTTPS) connections to the Tarantella Web Server with the tarantella webserver restart --ssl command.
3. Enable secure connections to the Tarantella server with the tarantella security start command.

Sharing a certificate for your own a web server with a Tarantella server

If you are using your own web server instead of the Tarantella Web Server and you want to share its certificate with a Tarantella server, you have to decrypt the certificate's key and then install it on the Tarantella server.

Note If your web server doesn't let you access the key or the key was not originally encrypted by a product that uses SSLeay or OpenSSL certificate libraries, you must obtain and install a separate X.509 certificate.

To share a certificate:

1. Copy the web server certificate and key file to a safe place that can only be accessed by root, for example:

   cp /usr/local/apache/certs/boston.indigo-insurance.com.pem install_dir/var/tsp/
   cp /usr/local/apache/certs/boston.indigo-insurance.com.key.pem install_dir/var/tsp/

2. Use the tarantella security decryptkey command to decrypt the certificate's key, for example:

   tarantella security decryptkey  \
     --enckey install_dir/var/tsp/boston.indigo-insurance.com.key.pem \
     --deckey install_dir/var/tsp/boston.indigo-insurance.com.key.out \
     --format PEM

3. Use the tarantella security certuse command to install the X.509 certificate using the decrypted key file, for example:

   tarantella security certuse
     --certfile install_dir/var/tsp/boston.indigo-insurance.com.pem
     --keyfile install_dir/var/tsp/boston.indigo-insurance.com.key.out

4. Enable secure connections to the Tarantella server with the tarantella security start command.