In the proxy server administration tool, click Home, click Certificate Maintenance, then click Create.

Specify an appropriate name for the certificate and subject name.

Click the Signature Algorithm drop-down list, then select the algorithm you want to use (SHA-1 or MD-5).

Click the RSA Key Size drop-down list, then select the RSA key size that you want to use.

You cannot select a key size larger than the maximum key size on the appliance.

Click Use External Certificate Authority.

If desired, specify a name for your organizational unit or division.

This is commonly referred to as the Organizational Unit and is used to differentiate between organizational divisions or to describe departments or divisions.

If desired, specify a name for your organization.

Specify the city or town where your organization does business.

Specify the non-abbreviated name of the state or province where the organization does business.

This is commonly referred to as the state.

Specify the International Standards Organization country code for the country where the organization does business.

This is commonly referred to as the country and must be a valid, two-character country code.

Click OK.

Examine the Action and Status fields. The Action field should have red arrows on the left and the word Request displayed on a green background. The Status should be Building. The red arrows and green background indicate that you need to click Apply.

Click Apply.

If any errors occur during the certificate request process, they are displayed in the Error field on a red background.

If an error occurs:

Click View CSR to open a new browser window that displays the CSR contents.

Select and copy the complete CSR text into your computer's Clipboard.

Paste the CSR text from the Clipboard to the e-mail message or HTML form as required by your CA. The method for sending the CSR varies depending on the authority. VeriSign, for example, uses a Web page interface.

----- BEGIN NEW CERTIFICATE REQUEST -----

----- END NEW CERTIFICATE REQUEST -----

In ConsoleOne, click Tools > Issue Certificate, then paste the CSR and follow the prompts to sign the certificate.

Click Finish and save the file in a .b64 format.

In ConsoleOne, go to the Organization CA object's properties page (in the Security container). Go to the Certificates > Self Signed Certificate page, then export the Self Signed Certificate in .b64 format.

In the proxy server administration tool, click Home, click Certificate Maintenance, then click the name of the certificate you want to store, then click Store Certificate.

In the Store Certificates dialog box, paste the CA certificate into the CA Certificate Contents box. If you are using Novell CA, this is where the Self Signed Certificate should be placed.

If the CA Certificate Contents and the Server Certificate Contents are in the same Base-64 encoded file, select the No Trusted Root Certificate Available check box. This will dim the CA Certificate Contents box and allow the single Base-64 encoded file containing the entire certificate chain to be pasted into the Server Certificate Contents box.

Paste your newly issued certificate in the Server Certificate Contents box.

Click Create.

Examine the Action and Status fields. The Action field should have red arrows on the left and the word Create displayed on a green background. The Status should be CSR in Process. The red arrows and green background indicate that you need to click Apply.

Click Apply.

If no error occurs during the certificate creation process, the status changes to Active.

If an error occurs during the certificate creation process, it is displayed in the Error field on a red background.

If an error occurs:

In the proxy server administration tool, click Configure, click Authentication, then click Insert, then specify a name for the profile (for example, “mutual”).

Select SSL Certificate Mutual Authentication, click OK, then click Apply.

Add the new profile to the Web Server Accelerator by clicking Configure, then click Web Server Accelerator.

Highlight the appropriate accelerator, then click Modify.

Click enable Authentication, click Authentication Options, then select the newly created profile.

Click Add, then click OK.

On the Accelerator page, in the Certificate drop-down selection box, select the name of the certificate you created, click OK, then click Apply.

In the proxy server administration tool, click Configure, then click Web Server Accelerator.

Select the appropriate Web accelerator, click Modify, then click Enable Secure Exchange.

Leave the SSL Listening Port as the default (443).

In ConsoleOne as an administrator, go to the user object's properties on the Security page, click Certificates, then click Create.

Select the default options (for example, with the private key). Change only what you need to change (for example, the expiration).

Do not change the subject name if it is shown in reverse (for example, o=novell,ou=stress,cn=user1020).

Save the file in .pfx format with a password.

You must be logged in as the user (not as an admin) to save this file in .pfx format.

In the browser, click Tools, then click Internet Options.

Click Content, then click Certificates.

Import a Personal Certificate that has been signed by the Certificate Authority.

Follow the prompts to import the certificate. You will be prompted to enter a password.

In the proxy server administration tool, click Configure, then click Authentication.

Select an authentication profile of type Mutual.

Click Modify, then click Mutual Options.