Generate a Certificate Signing Request and Import a Signed Certificate

To prevent browser warnings about untrusted certificates, you can have a certificate authority (CA) sign the server certificate for Tenable Network Monitor. Use the nnm-make-cert utility to generate a certificate signing request (CSR) for the CA to sign, and then import the signed certificate.

The nnm-make-cert utility creates the CSR from the existing server private key on the Tenable Network Monitor host. The private key never leaves the host, and the utility does not modify it.

Process Overview

1. On the Tenable Network Monitor host, generate a CSR with nnm-make-cert generate-csr.

2. Submit the CSR to your CA. The CA returns a signed server certificate and its CA certificate.

3. On the Tenable Network Monitor host, import the signed certificate with nnm-make-cert import-signed-cert.

Generate a Certificate Signing Request

Run nnm-make-cert generate-csr without options to accept the default values. For required values, such as the common name, Tenable Network Monitor uses the host name. Tenable Network Monitor leaves optional values, such as the organizational unit and email address, blank.

To generate a certificate signing request:

1. On the Tenable Network Monitor host, run the nnm-make-cert generate-csr command. Include any options you want to set. For example, to set the common name, subject alternative names, and output location:

   Operating System	Command
   Linux	# /opt/nnm/bin/nnm-make-cert generate-csr --cn=nnm.example.com --san=dns:nnm.example.com,ip:192.0.2.10 --output=/root/server.csr
   Windows	C:\Program Files\Tenable\NNM\nnm-make-cert.exe generate-csr --cn=nnm.example.com --san=dns:nnm.example.com,ip:192.0.2.10 --output=C:\certs\server.csr

   If you do not specify --output, Tenable Network Monitor creates the server.csr file in a temporary directory.

2. Submit the server.csr file to your CA.

3. When the CA returns the signed server certificate, save the signed certificate, the CA certificate, and (if provided) the server chain file to a location on the Tenable Network Monitor host.

generate-csr Options

Option	Description
--cn=<hostname>	The common name for the certificate. Default value: the host name of the Tenable Network Monitor host.
--country=<CC>	The two-letter ISO 3166-1 alpha-2 country code.
--state=<state>	The state or province.
--location=<city>	The city or locality.
--org=<name>	The organization name.
--orgunit=<unit>	The organizational unit.
--email=<address>	The contact email address.
--san=dns:<host>,ip:<address>,...	A comma-separated list of subject alternative names. Each entry must start with dns: or ip:.
--output=<csr_path>	The path where Tenable Network Monitor creates the CSR. Use this option to save the CSR to a directory you control instead of a temporary directory.
--no_x509_exts=1	Omits the x509 extensions that Tenable Network Monitor adds by default to meet NIAP requirements. Use this option only if the extensions conflict with your requirements.

x509 Extensions

By default, Tenable Network Monitor includes the following x509 extensions in the CSR to meet NIAP requirements:

Extension	Value
key_usage	critical, nonRepudiation, digitalSignature, keyEncipherment
ext_key_usage	serverAuth

Your CA or PKI expert must add the following extensions when signing the certificate:

Extension	Value
authority_key_identifier	keyid from the CA
subject_key_identifier	hash

Import a Signed Server Certificate

After your CA signs the CSR, import the signed certificate. The utility installs the signed certificate in the Tenable Network Monitor SSL directory as servercert.pem, replacing the existing file, and installs the CA certificate as cacert.pem.

The SSL directory for each operating system is:

Operating System	SSL Directory
Linux	/opt/nnm/var/nnm/ssl
Windows	C:\ProgramData\Tenable\NNM\nnm\ssl

To import a signed server certificate:

1. Back up the existing .pem files in the SSL directory.

2. On the Tenable Network Monitor host, run the nnm-make-cert import-signed-cert command with the paths to the files from your CA:

   Operating System	Command
   Linux	# /opt/nnm/bin/nnm-make-cert import-signed-cert --servercert=<path> --cacert=<path>
   Windows	C:\Program Files\Tenable\NNM\nnm-make-cert.exe import-signed-cert --servercert=<path> --cacert=<path>

3. Restart the Tenable Network Monitor service.

4. Connect to the Tenable Network Monitor web interface (https://<host>:8835) and confirm that your browser trusts the certificate.

import-signed-cert Options

Option	Description
--servercert=<server_cert_path>	The path to the signed server certificate from your CA. The utility installs this file in the Tenable Network Monitor SSL directory as servercert.pem.
--cacert=<cacert_path>	The path to the public certificate of your CA. The utility installs this file in the SSL directory as cacert.pem.
--serverchain=<serverchain_path>	Optional. The path to a file that establishes the chain of trust to your server certificate. If your CA provides multiple files, the file must include the complete trust chain. The utility installs this file in the SSL directory as serverchain.pem.
--verbose=1	Optional. Displays additional information if OpenSSL considers the certificates invalid.

The utility verifies the certificates against the CA certificates in the known_CA.inc and custom_CA.inc files in the Tenable Network Monitor plugins directory. If your CA is not in known_CA.inc, add your CA certificate to custom_CA.inc in the same directory.