Installing an SSL Certificate the Easy Way

KB Home   |   Installing an SSL Certificate the Easy Way

Main.SSLWithKeystoreExplorer History

Hide minor edits - Show changes to output

July 12, 2019, at 06:57 PM by 207.173.252.92 -
Changed line 126 from:
'''10)''' Copy the saved KeyStore to [@[install-path]/server/custom/@]\\
to:
'''10)''' Copy the saved [=KeyStore=] to [@[install-path]/server/custom/@]\\
March 27, 2019, at 04:54 AM by Mel Zouzoulas - Updated to mention the support web form
Changed lines 84-85 from:
If you see an error message, send an email to [[mailto:support@papercut.com?subject=SSL%20Configuration |support@papercut.com]] then grab a coffee. Most of the time, we will have replied before you have made it back to your desk.
to:
If you see an error message, reach out to us via (http://support.papercut.com) then grab a coffee. Most of the time, we will have replied before you have made it back to your desk.
Changed line 136 from:
If you see an error message, send an email to [[mailto:support@papercut.com?subject=SSL%20Configuration |support@papercut.com]] then grab a coffee. Most of the time, we will have replied before you have made it back to your desk.
to:
If you see an error message, reach out to us via (http://support.papercut.com) then grab a coffee. Most of the time, we will have replied before you have made it back to your desk.
September 05, 2018, at 08:56 PM by Aaron Pouliot - Renamed article to make it easier to find, per request from Frontline
Changed line 5 from:
!!Generate and import a certificate with KeyStore Explorer
to:
!!Generate and import a certificate with [=KeyStore=] Explorer
Changed lines 11-17 from:
!!Setting up KeyStore Explorer

Download and install the latest release of KeyStore Explorer from: http://www.keystore-explorer.org/downloads.html

Depending on the version of JRE you have installed, KeyStore Explorer might ask you to update Java's cryptography Libraries. Follow the prompts and it will guide you through this.

The video below demonstrates how to set up KeyStore Explorer
to:
!!Setting up [=KeyStore=]  Explorer

Download and install the latest release of [=KeyStore=] Explorer from: http://www.keystore-explorer.org/downloads.html

Depending on the version of JRE you have installed, [=KeyStore=] Explorer might ask you to update Java's cryptography Libraries. Follow the prompts and it will guide you through this.

The video below demonstrates how to set up [=KeyStore=] Explorer
Changed line 68 from:
'''5)''' Save your KeyStore.
to:
'''5)''' Save your [=KeyStore=] .
Changed line 71 from:
'''6)''' Set the password for your KeyStore, then click '''OK'''. Remember to make a note of this, as you will need to re-enter this later as the "server.ssl.keystore-password".
to:
'''6)''' Set the password for your [=KeyStore=] , then click '''OK'''. Remember to make a note of this, as you will need to re-enter this later as the "server.ssl.keystore-password".
Changed line 74 from:
'''7)''' Copy the saved KeyStore to [@[install-path]/server/custom/@]\\
to:
'''7)''' Copy the saved [=KeyStore=] to [@[install-path]/server/custom/@]\\
Changed line 120 from:
'''8)''' Save the KeyStore
to:
'''8)''' Save the [=KeyStore=]
Changed line 123 from:
'''9)''' Set a password for the KeyStore, then click '''OK'''
to:
'''9)''' Set a password for the [=KeyStore=] , then click '''OK'''
Changed line 141 from:
[-Keywords: SSL, Security, KeyStore Explorer, Certificate-]
to:
[-Keywords: SSL, Security, [=KeyStore=] Explorer, Certificate-]
September 05, 2018, at 08:54 PM by Aaron Pouliot - Renamed article to make it easier to find, per request from Frontline
Changed lines 3-5 from:
!!Use Keystore Explorer to import a new certificate onto your PaperCut server
Setting up PaperCut to use SSL/TLS can be fairly complicated if you take the command line approach and can sometimes lead to a few cups of coffee being needed before it works. To
take the pain away, there is an easier method you can use thanks to a free tool called [[http://keystore-explorer.org | Keystore Explorer]].
to:
''"Help! Im a Systems Administrator and I need to install a custom SSL Certificate onto our PaperCut server. What's the easiest way to do this?"''

!!Generate and import a certificate with KeyStore Explorer
Setting up PaperCut to use SSL/TLS can be fairly complicated if you
take the command line approach and can sometimes lead to a few cups of coffee being needed before it works. To take the pain away, there is an easier method you can use thanks to a free tool called [[http://keystore-explorer.org | KeyStore Explorer]].
Changed lines 9-17 from:
If youre an MF customer and wanting to update your SSL certificate, please reach out to your PaperCut Reseller or Authoized Solution Center for confirmation on the impact of this action. Changing the SSL certificate on your PaperCut server can temporarily prevent server access for some types of MFDs until a thumbprint is manually accepted at the MFDs panel, or a firmware update could be required.

!!Setting up Keystore Explorer

Download and install the latest release of Keystore Explorer from: http://www.keystore-explorer.org/downloads.html

Depending on the version of JRE you have installed, Keystore Explorer might ask you to update Java's cryptography Libraries. Follow the prompts and it will guide you through this.

The video below demonstrataes how to set up Keystore Explorer
to:
Before proceeding, if youre an MF customer and wanting to update your SSL certificate, please reach out to your PaperCut Reseller or Authorized Solution Center for confirmation on the impact of this action. Changing the SSL certificate on your PaperCut server can temporarily prevent server access for some types of MFDs until a thumbprint is manually accepted at the MFDs panel, or a firmware update could be required.

!!Setting up KeyStore Explorer

Download and install the latest release of KeyStore Explorer from: http://www.keystore-explorer.org/downloads.html

Depending on the version of JRE you have installed, KeyStore Explorer might ask you to update Java's cryptography Libraries. Follow the prompts and it will guide you through this.

The video below demonstrates how to set up KeyStore Explorer
Changed line 68 from:
'''5)''' Save your Keystore.
to:
'''5)''' Save your KeyStore.
Changed line 71 from:
'''6)''' Set the password for your Keystore, then click '''OK'''. Remember to make a note of this, as you will need to re-enter this later as the "server.ssl.keystore-password".
to:
'''6)''' Set the password for your KeyStore, then click '''OK'''. Remember to make a note of this, as you will need to re-enter this later as the "server.ssl.keystore-password".
Changed line 74 from:
'''7)''' Copy the saved Keystore to [@[install-path]/server/custom/@]\\
to:
'''7)''' Copy the saved KeyStore to [@[install-path]/server/custom/@]\\
Changed line 120 from:
'''8)''' Save the Keystore
to:
'''8)''' Save the KeyStore
Changed line 123 from:
'''9)''' Set a password for the Keystore, then click '''OK'''
to:
'''9)''' Set a password for the KeyStore, then click '''OK'''
Changed line 126 from:
'''10)''' Copy the saved Keystore to [@[install-path]/server/custom/@]\\
to:
'''10)''' Copy the saved KeyStore to [@[install-path]/server/custom/@]\\
Changed line 141 from:
[-Keywords: SSL, Security, Keystore Explorer, Certificate-]
to:
[-Keywords: SSL, Security, KeyStore Explorer, Certificate-]
September 05, 2018, at 08:50 PM by Aaron Pouliot - Renamed article to make it easier to find, per request from Frontline
Changed lines 1-2 from:
(:title SSL with PaperCut and Keystore Explorer:)
to:
(:title Installing an SSL Certificate the Easy Way:)

!!Use Keystore Explorer to import a new certificate onto your PaperCut server
August 27, 2018, at 04:54 AM by jamesv - Added note about talking to your reseller or ASC first
Added lines 4-6:

!!!Note:
If youre an MF customer and wanting to update your SSL certificate, please reach out to your PaperCut Reseller or Authoized Solution Center for confirmation on the impact of this action. Changing the SSL certificate on your PaperCut server can temporarily prevent server access for some types of MFDs until a thumbprint is manually accepted at the MFDs panel, or a firmware update could be required.
July 19, 2018, at 05:36 PM by Aaron Pouliot - Added note to explain where the key and keystore passwords will be used later.
Changed line 40 from:
'''11)''' Set the password for your key, then click '''OK'''
to:
'''11)''' Set the password for your key, then click '''OK'''.  Remember to make a note of this, as you will need to re-enter this later as the "server.ssl.key-password".
Changed line 65 from:
'''6)''' Set the password for your Keystore, then click '''OK'''
to:
'''6)''' Set the password for your Keystore, then click '''OK'''. Remember to make a note of this, as you will need to re-enter this later as the "server.ssl.keystore-password".
March 30, 2018, at 08:41 PM by 207.173.252.92 - Changed papercut:9192 to your.fully.qualified.domain.name:9192
Changed lines 75-76 from:
'''9)''' Restart the PaperCut Application Server service and check https://papercut:9192/admin
to:
'''9)''' Restart the PaperCut Application Server service and check https://your.fully.qualified.domain.name:9192/admin
Changed line 127 from:
'''12)''' Restart the PaperCut Application Server service and check https://papercut:9192/admin
to:
'''12)''' Restart the PaperCut Application Server service and check https://your.fully.qualified.domain.name:9192/admin
October 27, 2017, at 07:48 PM by 207.173.252.92 -
Changed lines 69-70 from:
'''8)''' Edit [@[install-path]/server/server.properties@] and change the values below to match your filename and passwords
to:
'''8)''' Edit [@[install-path]/server/server.properties@] and change the values below to match your filename and passwords and remember to remove the # signs to enable these keys.
Changed line 121 from:
'''11)''' Edit [@[install-path]/server/server.properties@] and change the values below to match your filename and passwords
to:
'''11)''' Edit [@[install-path]/server/server.properties@] and change the values below to match your filename and passwords and remember to remove the # signs to enable these keys.
Changed lines 12-13 from:
(:youtube {FsafOr5BPYc}:)
to:
(:youtube FsafOr5BPYc :)
Changed lines 45-47 from:
(:youtube {IkiXFj8RnBs}:)

to:
(:youtube IkiXFj8RnBs:)

Changed line 82 from:
(:youtube {pi1aLVkuCUg}:)
to:
(:youtube pi1aLVkuCUg :)
June 29, 2017, at 03:05 PM by priyanka - Added the videos recorded by Ross and team in this KB
Added line 11:
The video below demonstrataes how to set up Keystore Explorer
Added lines 11-12:
(:youtube {FsafOr5BPYc}:)
Added lines 41-45:

The video below demonstrates how to create a new certificate:

(:youtube {IkiXFj8RnBs}:)

Added lines 71-74:

The video below demonstrates how to generate a CSR:

(:youtube {pi1aLVkuCUg}:)
Changed line 13 from:
'''1)''' Click '''Create a new KeyStore'''
to:
'''1)''' Click '''Create a new [=KeyStore=]'''
Changed line 30 from:
'''8)''' In the '''Common Name''' field, enter the '''Fully Qualified Domain Name''' (link users will access) for your PaperCut server, then click '''OK'''
to:
'''8)''' In the '''Common Name''' field, enter the '''Fully Qualified Domain Name''' (link users will access) for your PaperCut server. Fill out the other fields according to your organiaztion's details, then click '''OK'''
Changed lines 40-41 from:
!! Generating a CSR and importing the response
to:
!! Generating a Certificate Signing Request (CSR) and importing the response
Changed lines 48-50 from:
'''3)''' When you get your certificate back from your CA, right-click the key, then select '''Import CA Reply''' then select '''From File''' and browse to the CRT file
to:
'''3)''' Apply for a certificate with your Certificate Authority (CA) by providing them the CSR.

'''4)''' The CA will provide your new certificate, plus one or more "CA certs" (the certificate of the CA, and maybe their upstream CA, etc.). If they have provided a "bundle" (all the certs in the one file). Otherwise, choose the file that represents your certificate. Right-click the key, then select '''Import CA Reply''' then select '''From File''' and browse to the chosen certificate file (probably @@.crt@@)
Changed lines 52-53 from:

'''4)'''
Save your Keystore.
to:
If there are several separate certificate files, you might need to edit the certificate chain to ensure all the certificates are in there. Get in touch if you need a hand.

'''5
)''' Save your Keystore.
Changed line 57 from:
'''5)''' Set the password for your Keystore, then click '''OK'''
to:
'''6)''' Set the password for your Keystore, then click '''OK'''
Changed lines 60-62 from:
'''6)''' Copy the saved Keystore to [@[install-path]/server/custom/@]\\
'''7)''' Edit [@[install-path]/server/server.properties@] and change the values below to match your filename and passwords
to:
'''7)''' Copy the saved Keystore to [@[install-path]/server/custom/@]\\
'''8)''' Edit [@[install-path]/server/server.properties@] and change the values below to match your filename and passwords
Changed line 67 from:
'''8)''' Restart the PaperCut Application Server service and check https://papercut:9192/admin
to:
'''9)''' Restart the PaperCut Application Server service and check https://papercut:9192/admin
July 20, 2016, at 05:52 PM by Jonathan - Initial version
Added lines 1-120:
(:title SSL with PaperCut and Keystore Explorer:)

Setting up PaperCut to use SSL/TLS can be fairly complicated if you take the command line approach and can sometimes lead to a few cups of coffee being needed before it works. To take the pain away, there is an easier method you can use thanks to a free tool called [[http://keystore-explorer.org | Keystore Explorer]].

!!Setting up Keystore Explorer

Download and install the latest release of Keystore Explorer from: http://www.keystore-explorer.org/downloads.html

Depending on the version of JRE you have installed, Keystore Explorer might ask you to update Java's cryptography Libraries. Follow the prompts and it will guide you through this.

!!Creating a new Certificate

'''1)''' Click '''Create a new KeyStore'''
Attach:01_create-keystore.jpg

'''2)''' Select '''JKS''', then click '''OK'''
Attach:02_select-jks.jpg

'''3)''' click the '''Generate Key Pair''' icon to generate a Key Pair
Attach:03_generate-keypair.jpg

'''4)''' Select '''RSA''', then set the '''Key Size''' for your new certificate to either '''2048''' or '''4096'''\\
'''5)''' Click '''OK'''
Attach:04_select-keysize.jpg

'''6)''' In the '''Validity Period''' field, set how long the certificate will be valid for\\
'''7)''' Click the address book icon
Attach:05_set-years-click-address-icon.jpg

'''8)''' In the '''Common Name''' field, enter the '''Fully Qualified Domain Name''' (link users will access) for your PaperCut server, then click '''OK'''
Attach:06_fill-out-info.jpg

'''9)''' Click '''OK'''\\
'''10)''' In the '''Enter Alias''' field, set an alias so you know what the key is for, then click '''OK'''
Attach:07_enter-alias.jpg

'''11)''' Set the password for your key, then click '''OK'''
Attach:08_set-key-password.jpg

!! Generating a CSR and importing the response

'''1)''' Right-click on your Key Pair, then select '''Generate CSR'''
Attach:09_generate-csr.jpg

'''2)''' In the CSR File field, set the output path for the CSR, then click '''OK'''
Attach:10_save-path-sig-alg.jpg

'''3)''' When you get your certificate back from your CA, right-click the key, then select '''Import CA Reply''' then select '''From File''' and browse to the CRT file
Attach:11_import-ca-reply.jpg

'''4)''' Save your Keystore.
Attach:12_save.jpg

'''5)''' Set the password for your Keystore, then click '''OK'''
Attach:13_keystore-password.jpg

'''6)''' Copy the saved Keystore to [@[install-path]/server/custom/@]\\
'''7)''' Edit [@[install-path]/server/server.properties@] and change the values below to match your filename and passwords

--->[@server.ssl.keystore=custom/papercut-keystore@]
--->[@server.ssl.keystore-password=papercut@]
--->[@server.ssl.key-password=papercut@]

'''8)''' Restart the PaperCut Application Server service and check https://papercut:9192/admin

If you dont see any errors, congratulations! You can now reward yourself with a coffee.
If you see an error message, send an email to [[mailto:support@papercut.com?subject=SSL%20Configuration |support@papercut.com]] then grab a coffee. Most of the time, we will have replied before you have made it back to your desk.

!! Importing an Existing Certificate

'''1)''' Click '''Create a new Key Store'''
Attach:01_create-keystore.jpg

'''2)''' Select '''JKS''', then click '''OK'''
Attach:02_select-jks.jpg

'''3)''' Click the '''Import Key Pair''' icon
Attach:03a_import-key-pair.jpg

'''4)''' Select the type of certificate you are using, then click '''OK'''
Attach:04a_select-keystore-type.jpg

[@This is normally PKCS12 (.pfx, .p12), but it depends on where your certificate came from.@]

'''5)''' Click Details to verify the certificate. If you get an error, it could be the password or the wrong certificate type

Attach:04b_pkcs12.jpg
[@pkcs12 import@]

Attach:04c_pkcs8.jpg
[@pkcs8 import@]

'''6)''' In the '''Enter Alias''' field, enter an alias for the newly imported Certificate, then click '''OK'''
Attach:07_enter-alias.jpg

'''7)''' Set a password for the key, then click '''OK'''
Attach:08_set-key-password.jpg

'''8)''' Save the Keystore
Attach:12_save.jpg

'''9)''' Set a password for the Keystore, then click '''OK'''
Attach:13_keystore-password.jpg

'''10)''' Copy the saved Keystore to [@[install-path]/server/custom/@]\\
'''11)''' Edit [@[install-path]/server/server.properties@] and change the values below to match your filename and passwords

--->[@server.ssl.keystore=custom/papercut-keystore@]
--->[@server.ssl.keystore-password=papercut@]
--->[@server.ssl.key-password=papercut@]

'''12)''' Restart the PaperCut Application Server service and check https://papercut:9192/admin

If you dont see any errors, congratulations! You can now reward yourself with a coffee.
If you see an error message, send an email to [[mailto:support@papercut.com?subject=SSL%20Configuration |support@papercut.com]] then grab a coffee. Most of the time, we will have replied before you have made it back to your desk.

----
''Categories:'' [[Category.Security|+]]
----
[-Keywords: SSL, Security, Keystore Explorer, Certificate-]

Comments

Share your findings and experience with other PaperCut users. Feel free to add comments and suggestions about this Knowledge Base article. Please don't use this for support requests.

Article last modified on July 12, 2019, at 06:57 PM
Printable View   |   Article History   |   Edit Article