DESCRIPTION:

ARTICLE:

• Go to Start=>Run and enter "cmd" to open a command-line prompt. Type
  cd c:\openssl\bin
  and hit Enter.
  
  
  
• Enter the following command:
  openssl genrsa -out YOURMACHINENAMEHERE.key 1024
  and hit Enter. This will generate a private key, which will be used to create a certificate request.
  
  
  
• Enter the following command:
  openssl req -new -key YOURMACHINENAMEHERE.key -out YOURMACHINENAMEHERE.csr
  and hit Enter.
  
  
  
• You will then receive a series of prompts for information that will be used to generate the CSR. Fill in the values as they are correct for your organization. A sample with notes is provided below. User-provided information is in italics.
  
  Country Name (2 letter code) [AU]: US
  
  State or Province Name (full name) [Some-State]:TX
  
  Locality Name (eg, city) []:Houston
  
  Organization Name (eg, company) [Internet Widgits Pty Ltd]:YOUR COMPANY NAME
  
  Organizational Unit Name (eg, section) []:
  
  Common Name (eg, YOUR name) []:YOUR-MACHINE-NAME (Note: This is the name that will be used when connected to your SnapStream Enterprise TV Server’s Web Admin. You can choose a fully qualified name (computername.yourcompany.com) or an internal-only name (computername) depending on your needs. Users who plan to allow connections to the Web Admin from outside their internal network (i.e. over the Internet) should use a fully qualified name.)
  
  Email Address []:administrator-email@yourdomain.com
  
  Please enter the following 'extra' attributes to be sent with your certificate request
  A challenge password []: (Note: Do not lose this password)
  
  An optional company name []: YOUR COMPANY NAME
  
  
  
• After this process is complete, a file called YOURMACHINENAMEHERE.csr will appear in the directory C:\OpenSSL\bin.
  
  
  
  

• After you have your certificate, download it to your Enterprise TV Server in the c:\openssl\bin directory.
  
  
  
• Go to Start=>Run and type “cmd” to open a command-line prompt. Type
  cd\ c:\openssl\bin
  and hit Enter.
  
  
  
• Enter the following command:
  C:\OpenSSL\bin>openssl pkcs12 -export -out YOURMACHINENAMEHERE.pfx -in YOURMACHINENAMEHERE.crt -inkey YOURMACHINENAMEHERE.key -name "YOURMACHINENAMEHERE"
  
  
  
• You see the following prompts:
  Enter Export Password: [leave this blank]
  Verifying - Enter Export Password: [leave this blank]
  
  
  
• A file called YOURMACHINENAMEHERE.pfx will now appear in C:\OpenSSL\bin.
  
  
  
  

• Shut down all Enterprise TV services.
  
  
  
• In Windows Explorer, navigate to
  C:\Documents and Settings\All Users\Application Data\SnapStream\Beyond TV
  
  
  
• Rename cert.pfx to cert.pfx.old
  
  
  
• Copy
  C:\OpenSSL\bin\YOURMACHINENAMEHERE.pfx
  to
  C:\Documents and Settings\All Users\Application Data\SnapStream\Beyond TV
  
  
  
• Rename YOURMACHINENAMEHERE.pfx to cert.pfx
  
  
  
• Start Enterprise TV.

• If your certificate expires, your users will start seeing errors that they aren't used to. Make sure to add a reminder to renew your certificate before it expires (after whatever period you chose when you set it up).
  
  
  
• Back up YOURMACHINENAMEHERE.pfx to somewhere very safe.
  
  
  
• Back up C:\OpenSSL\bin\YOURMACHINENAMEHERE.* to an external location. For security reasons, these files should then be removed the the Enterprise TV Server. Only the cert.pfx file in the Application Data folder should be left on the server.

Also, sometimes you will have to enforce FIPS Certified Cryptography in order to access the Web Admin. Usually this applies to government agencies, they require adhering to a strict set of guidelines, especially when it comes to security. This provides the ability for you to enforce that only cryptographic algorithms that have been FIPS 140-1 certified can be used.
We strongly advise for you to contact your System Administrator before attempting to make this change

On Windows XP and higher this switch is settable via Windows security settings or the registry. To enable the setting in the Windows Security settings, you should set the "System cryptography: Use FIPS compliant algorithms for encryption, hashing and signing" security option to enabled.