Install TLS certificates in VM packaging

Install a TLS certificate

1. Obtain certificate files from a preferred TLS vendor: public key, private key, intermediate certificate, and root certificate.
2. On the Halon node, make sure that the system is in a known state; no undeployed changes.
3. Click on Configuration -> Global -> Certificates and keys.
4. Keep any existing certificate/key pair.
5. Click on the + Add button.
6. Select Type: X.509 and private key.
7. In the X.509 and private key box, insert the keys and certificates in the following order:
   public key
   private key
   intermediate certificate
   root certificate
8. Enter a descriptive text in the Comment box.
9. Click on the Save button.

Assign a TLS certificate to an SMTP listener

1. On the Halon node, make sure that the system is in a known state; no undeployed changes.
2. Click on Configuration -> Server -> Listeners.
3. Click on the SMTP listener to be assigned to a TLS certificate.
4. Under TLS, STARTTLS, select the desired TLS certificate in the drop-down list under Certificate.
5. Click on the Save button.
6. Deploy the working copy to apply the new configuration, or use Live staging to test and verify the certificate before deployment.

Assign a TLS certificate to an HTTPS listener

1. Obtain certificate files from a preferred TLS vendor: public key, private key, intermediate certificate, and root certificate.
2. On the Halon node, make sure that the system is in a known state; no undeployed changes.
3. Click on Hosts -> Services -> Web admin.
4. Under Host selector, click on the host on which an HTTP listener is to be assigned to a TLS certificate.
5. Click on the HTTPS listener to be assigned to a TLS certificate.
6. In the TLS (HTTPS) box, replace the keys and certificates by inserting the new set in the following order:
   public key
   private key
   intermediate certificate
   root certificate
7. Click on the Save and apply button.

Note that, if using clustering over HTTPS, when replacing a HTTPS TLS certificate in a Halon node, the communication between this node and any other Halon node in the cluster will be disconnected. Each Halon node in the cluster must be updated with the MD5 TLS fingerprint value, obtained from the new HTTPS TLS certificate, under Hosts -> Cluster.

Install a TLS certificate to the FTPS service

1. Obtain certificate files from a preferred TLS vendor: public key, private key, intermediate certificate, and root certificate.
2. On the Halon node, make sure that the system is in a known state; no undeployed changes.
3. Click on Hosts -> Services -> FTP server.
4. Under TLS (FTPS), tick the Enable box.
5. In the TLS (FTPS) box, insert the keys and certificates in the following order:
   public key
   private key
   intermediate certificate
   root certificate
6. Click on the Save and apply button.