Regenerate the Tenable Security Center Server Certificate

Required Tenable Security Center User Role: tns user

Required Tenable Security Center User Role: Root user

Tenable Security Center ships with a default server certificate that is valid for two years. After the certificate expires, you must regenerate the SSL certificate.

To regenerate the Tenable Security Center SSL certificate:

  1. Log in to Tenable Security Center via the command line interface (CLI).

  2. In the CLI in Tenable Security Center, run the following command to switch to the tns user:

    su - tns

  3. As the tns user, run the following command:

    /opt/sc/support/bin/php /opt/sc/src/tools/installSSLCertificate.php

    (Optional) If you want to suppress the self-signed warning or specify a Common Name, include an optional argument.

    Argument Description
    -q Suppresses the warning: This script generates a self-signed SSL certificate, which is not recommended for production.
    -h <IP|host name> Specifies an IP address or hostname that will be used as the Common Name for the certificate.

    Note: Tenable Security Center recommends running this command as the tns user, as shown above. If you run the command as the root user instead, you must ensure /opt/sc/support/lib is included in the LD_LIBRARY_PATH environment variable.

    If the script completes without errors, Tenable Security Center has generated a new certificate. If the script reports an error, verify that you provided a valid IP address or hostname with the -h argument and that you are running the command as the tns user.

  4. Run the following command to exit the tns user:

    exit

  5. As the root user, run the following command to restart the Tenable Security Center service:

    # service SecurityCenter restart

    The service restarts and Tenable Security Center applies the new certificate.

    Note: After the service restarts, your browser may still display the old or expired certificate until you clear the browser cache or close and reopen the browser tab.

  6. (Optional) Verify the new certificate is in place by running the following command to check the certificate dates:

    openssl x509 -in /opt/sc/support/conf/SecurityCenter.crt -noout -dates

    The output shows the notBefore and notAfter dates for the certificate. Confirm that notBefore reflects today's date and notAfter is two years in the future.