The Control Center web server uses a self-signed certificate to establish secure HTTPS connections. Your company’s security policy may require you to replace the web server private key and certificate in order to use Dr.Web Enterprise Security Suite. In this case you can replace the original web server files with your own or use the drwsign utility shipped with Dr.Web Enterprise Security Suite to generate a new private key and self-signed certificate and replace the files.
To replace the web server private key and certificate with your own files
1.Make sure that you have separate private key and certificate files in the PEM format at your disposal.
|
Only PEM files with no empty lines between the header and body of the certificate are allowed. The file may be a certificate or a certificate chain.
You can use the openssl toolkit to extract the private key and certificate from a PFX file, as well as to convert your private key and certificate in another format to PEM. Detailed information on using the toolkit is provided on the official OpenSSL website at https://docs.openssl.org/3.6/man1/openssl/. |
2.Rename your private key file to private-key.pem and your certificate file to certificate.pem.
3.Copy the original web server files named private-key.pem and certificate.pem from the following folder to another one as a backup copy:
•Windows: %programfiles%\DrWeb Server\etc
•Linux: /var/opt/drwcs/etc
•FreeBSD: /var/drwcs/etc
4.Replace the original private-key.pem and certificate.pem web server files in the etc subfolder with your own files.
|
If your computer is running Windows OS and is under the protection of a Dr.Web product, you will need to temporarily disable the Self-Protection component in order to replace the files. 1.Open the Dr.Web menu and select Security Center. 2.Make sure that Dr.Web is operating in administrative mode (the lock in the bottom part of the program is “open”). Otherwise click the lock icon. 3.Click Settings in the upper part of the program window. 4.A window with the main settings of the program will open. Click the Self-Protection item in the left part of the window. 5.Use the Enable Self-Protection (recommended) toggle button to disable Self-Protection. Once you are done manipulating the files, re-enable the component to allow it to continue protecting the integrity of files in Dr.Web products. |
5.In a Unix-like OS: assign the drwcs user as the owner of the files you replaced in the etc subfolder.
•Linux:
# chown drwcs: /var/opt/drwcs/etc/private-key.pem /var/opt/drwcs/etc/certificate.pem |
•FreeBSD:
# chown drwcs: /var/drwcs/etc/private-key.pem /var/drwcs/etc/certificate.pem |
6.Restart Dr.Web Server.
•Windows: using Windows OS service management tools or the Start → All programs → Dr.Web Server → Restart menu.
•Linux:
# /etc/init.d/drwcsd restart |
•FreeBSD:
# /usr/local/etc/rc.d/drwcsd restart |
7.Wait a few minutes and try to connect to the Control Center.
You can also use the drwsign digital key and certificate generation utility in order to generate a new private key and self-signed certificate and place them in the appropriate folder.
|
Detailed information on the features and command format of the drwsign utility is provided in the G7.1. Digital Keys and Certificates Generation Utility section. |
To generate and replace the web server private key and certificate using the drwsign utility
1.Copy the original private-key.pem private key and certificate.pem certificate files used by the web server from the following folder to another one as a backup copy:
•Windows: %programfiles%\DrWeb Server\etc
•Linux: /var/opt/drwcs/etc
•FreeBSD: /var/drwcs/etc
2.Run the following command to generate a new private-key.pem private key file and a certificate.pem self-signed certificate file and replace the original files in the etc subfolder.
•Windows:
"C:\Program Files\DrWeb Server\bin\drwsign.exe" genselfsign "C:\Program Files\DrWeb Server\etc\private-key.pem" "C:\Program Files\DrWeb Server\etc\certificate.pem" |
•Linux:
# /opt/drwcs/bin/drwsign genselfsign /var/opt/drwcs/etc/private-key.pem /var/opt/drwcs/etc/certificate.pem |
•FreeBSD:
# /usr/local/drwcs/bin/drwsign genselfsign /var/drwcs/etc/private-key.pem /var/drwcs/etc/certificate.pem |
3.In a Unix-like OS: assign the drwcs user as the owner of the generated files.
•Linux:
# chown drwcs: /var/opt/drwcs/etc/private-key.pem /var/opt/drwcs/etc/certificate.pem |
•FreeBSD:
# chown drwcs: /var/drwcs/etc/private-key.pem /var/drwcs/etc/certificate.pem |
4.Restart Dr.Web Server.
•Windows: using Windows OS service management tools or the Start → All programs → Dr.Web Server → Restart menu.
•Linux:
# /etc/init.d/drwcsd restart |
•FreeBSD:
# /usr/local/etc/rc.d/drwcsd restart |
5.Wait a few minutes and try to connect to the Control Center.