Certificate Management

The Certificate Management page is where private keys and certificates used by QIE's TLS-secured connections are generated, imported, and exported. Before generating or sharing anything, identify which kind of certificate the connection actually needs. Most certificate problems come from confusing standard TLS with client-authenticated TLS, or from sending out a private key when a public certificate was what was asked for.

Each certificate in the list shows its expiration date beneath its name, color-coded by urgency: green when more than 90 days remain, yellow when 90 days or fewer remain, and red when 7 days or fewer remain (or the certificate has expired). Selecting a private key marks the certificates generated from it with a dot, and selecting a certificate marks its private key the same way.

Do not use the deprecated trustStore JVM arguments

The JVM arguments -Djavax.net.ssl.trustStore and -Djavax.net.ssl.trustStorePassword are deprecated and must not be set on the QIE service. Manage all trusted certificates from this page instead. Leaving these arguments configured against a missing or stale truststore prevents QIE from starting and produces java.security.NoSuchAlgorithmException: Error constructing implementation when loading the admin console.

Start here

Which Certificate Do I Need?: the question to answer before generating or requesting anything.

Tasks

• Generating a Private Key covers the name, password, and key size.
• Generating a CSR or Self-Signed Certificate covers the certificate request fields and what a certificate authority expects in each.
• Importing Certificates and Keys covers bringing in a certificate or key produced elsewhere.
• Exporting Certificates and Keys covers handing a public certificate to a trading partner without leaking the private key.

Operations

• Certificate Expiry Alerts warn you before a certificate lapses.
• Disabling TLS Protocol Versions covers turning off protocol versions a partner or auditor rejects.
• Troubleshooting TLS Handshake Failures covers what to check when a connection does not negotiate.

Background

• Keys explains what a key pair is and how the two halves are used.
• Certificates explains what a certificate asserts and who vouches for it.
• SSL/TLS Connections explains how the handshake uses keys and certificates.
• Client-authenticated TLS explains mutual TLS, and how it differs from standard TLS.
• Digital Signatures explains signing and verification.