Regenerate the Tenable Security Center Director Server Certificate

Required Tenable Security Center User Role: tns user

Required Tenable Security Center User Role: Root user

Tenable Security Center Director ships with a default server certificate that is valid for two years. After the certificate expires, you must regenerate the SSL certificate.

To regenerate the Tenable Security Center Director SSL certificate:

  1. Log in to Tenable Security Center Director via the command line interface (CLI).

  2. In the CLI in Tenable Security Center Director, run the following command to switch to the tns user:

    su - tns

  3. As the tns user, run the following command:

    /opt/sc/support/bin/php /opt/sc/src/tools/installSSLCertificate.php -h <IP|host name>

    Note: The -h argument is required. Provide the IP address or hostname that clients use to access Tenable Security Center Director. This value is set as the Common Name for the new certificate.

    (Optional) Include the argument -q to suppress the warning: This script generates a self-signed SSL certificate, which is not recommended for production.

    Note: Tenable Security Center Director recommends running this command as the tns user, as shown above. If you run the command as the root user instead, you must ensure /opt/sc/support/lib is included in the LD_LIBRARY_PATH environment variable.

    If the script completes without errors, Tenable Security Center Director has generated a new certificate. If the script reports an error, verify that you provided a valid IP address or hostname with the -h argument and that you are running the command as the tns user.

  4. Run the following command to exit the tns user:

    exit

  5. As the root user, run the following command to restart the Tenable Security Center Director service:

    # service SecurityCenter restart

    The service restarts and Tenable Security Center Director applies the new certificate.

    Note: After the service restarts, your browser may still display the old or expired certificate until you clear the browser cache or close and reopen the browser tab.

  6. (Optional) Verify the new certificate is in place by running the following command to check the certificate dates:

    openssl x509 -in /opt/sc/support/conf/SecurityCenter.crt -noout -dates

    The output shows the notBefore and notAfter dates for the certificate. Confirm that notBefore reflects today's date and notAfter is two years in the future.