Wiki source code of Allgemein - Kommbox- bzw. TCMS Webserver Zertifikat austauschen
Last modified by Tobias Wintrich on 2026/09/18 09:05
Hide last authors
| author | version | line-number | content |
|---|---|---|---|
 |
15.1 | 1 | (% class="box infomessage" %) |
| 2 | ((( | ||
| |
16.1 | 3 | This howto was created and tested with the following versions: |
| 4 | **Firmware**: **firmware x64 - 13.00 build 206** | ||
| |
15.1 | 5 | ))) |
| |
5.1 | 6 | |
| |
16.1 | 7 | The web server certificate used on a RangeeOS (with or without TCMS) can be replaced if required. The certificate can be provided either Base64-encoded (PEM) or in PFX format. |
| 8 | |||
| |
4.2 | 9 | |
| |
15.1 | 10 | {{toc/}} |
| 11 | |||
| |
16.1 | 12 | = Creating a certificate signing request file (optional) = |
| |
15.1 | 13 | |
| 14 | (% class="box infomessage" %) | ||
| 15 | ((( | ||
| |
16.1 | 16 | This step is optional. The certificate can also be generated entirely externally. |
| |
15.1 | 17 | \\~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~- |
| |
16.1 | 18 | The "openssl" commands used in this guide can generally be executed on any PC with openssl installed. They can, but do not have to, be executed on the thin client side. If you want to run the commands directly on the RangeeOS, you need corresponding root access as well as tools for transferring files to and from the thin client. |
| |
15.1 | 19 | |
| |
16.1 | 20 | * [[Root terminal password>>doc:Handbuecher.Handbuch11.Kapitel 3 - Administration des Clients.3\.C Benutzereinstellungen.3\.C\.A\. Root-Terminal-Passwort]] | It is recommended to set a dedicated, fixed password for the user for potential troubleshooting. |
| 21 | * E. g.: [[WinSCP >>https://winscp.net/eng/download.php]] for transferring files from Windows to RangeeOS. | ||
| 22 | This guide describes the steps for executing the commands directly on the RangeeOS side. | ||
| 23 | Log in as user "[[admin>>doc:Handbuecher.Handbuch11.Kapitel 3 - Administration des Clients.3\.C Benutzereinstellungen.3\.C\.A\. Root-Terminal-Passwort]]" on the client via a terminal ({{status title="CTRL"/}} + {{status title="SHIFT"/}} + {{status title="ALT"/}} + {{status title="T"/}}) or an SSH connection on the RangeeOS. | ||
| |
15.1 | 24 | ))) |
| |
4.2 | 25 | |
| |
16.1 | 26 | 1. Adjust the parameters of the following command according to your requirements and execute it on the device:{{code language="bash"}}openssl req -newkey rsa:4096 -sha256 -keyout key.pem -out req.pem \ |
| |
8.1 | 27 | -subj "/C=DE/ST=Bundesland/L=Stadt/O=Einrichtung/OU=Abteilung/OU=Team/CN=<FQDN>" \ |
| 28 | -addext "subjectAltName = DNS:<DNS>,IP:<IP>"{{/code}} | ||
| |
7.1 | 29 | 1*. **C/ST/L/O/OU** |
| |
16.1 | 30 | Optional and freely selectable |
| |
7.1 | 31 | 1*. **<FQDN>**: |
| |
16.1 | 32 | The hostname under which the RangeeOS will later be addressed |
| |
8.1 | 33 | 1*. **<DNS>:** |
| |
16.1 | 34 | Hostname of the TCMS for which the certificate should be valid |
| |
7.1 | 35 | 1*. **<IP>:** |
| |
16.1 | 36 | Optional. IP of the TCMS for which the certificate should be valid. If the IP should not be part of the certificate, remove the corresponding section. |
| 37 | 1*. Example of a complete command: | ||
| |
8.1 | 38 | {{code language="bash"}}openssl req -newkey rsa:4096 -sha256 -keyout key.pem -out req.pem \ |
| 39 | -subj "/C=DE/ST=NRW/L=Aachen/O=Rangee/OU=Support/OU=Zertifikatstest/CN=tc-b0416f05c363.rangee.local" \ | ||
| 40 | -addext "subjectAltName = DNS:tc-b0416f05c363.rangee.local,IP:192.168.50.29"{{/code}} | ||
| |
16.1 | 41 | 1. After submitting the command, assign a password for your private key (at least 4 characters). |
| 42 | 1. Since the private key for the server certificate is required without a password, you must subsequently remove the password with this command: | ||
| |
8.1 | 43 | {{code language="bash"}}openssl rsa -in key.pem -out key.pem{{/code}} |
| |
16.1 | 44 | 1. Connect using "WinSCP" and the "admin" credentials to the client and download the request file "///tmp/req.pem//" as well as "///tmp/key.pem//". |
| 45 | 1. Submit the file req.pem to any certification authority. If you have the option, request a Base64-encoded certificate directly. Once you have received the certificate, proceed with the next step. | ||
| |
5.1 | 46 | |
| |
16.1 | 47 | = Importing a certificate = |
| |
4.2 | 48 | |
| |
16.1 | 49 | You can upload an existing certificate via the Kommbox under {{status title="Remote Administration"/}}. Depending on the certificate format, select **Upload web server certificate** (PEM/Base64) or **Upload PFX certificate**. |
| 50 | |||
| 51 | (% class="box infomessage" %) | ||
| 52 | ((( | ||
| 53 | A certificate in PEM format must contain both the server certificate and the matching private key. When you open the certificate with a text editor, the content should be displayed in this form: | ||
| 54 | //~-~-~-~--BEGIN RSA PRIVATE KEY~-~-~-~-- | ||
| 55 | […] | ||
| 56 | ~-~-~-~--END RSA PRIVATE KEY~-~-~-~-- | ||
| 57 | ~-~-~-~--BEGIN CERTIFICATE~-~-~-~-- | ||
| 58 | […] | ||
| 59 | ~-~-~-~--END CERTIFICATE~-~-~-~--// | ||
| 60 | ))) | ||
| 61 | |||
| |
15.1 | 62 | [[image:1789713314582-112.png]] |
| |
4.2 | 63 | |
| |
16.1 | 64 | You can upload an existing certificate via the Kommbox under {{status title="Remote Administration"/}}. Depending on the certificate format, select **Upload web server certificate** (PEM/Base64) or **Upload PFX certificate**. |
| 65 | |||
| 66 | |||
| |
15.1 | 67 | [[image:1789713455962-680.png]] |
| |
4.2 | 68 | |
| 69 | |||
| |
16.1 | 70 | Afterwards, a restart of the RangeeOS is necessary. |
| 71 | After the restart, the certificate will be displayed as valid in the browser. | ||
| |
8.1 | 72 | |
| |
16.1 | 73 | |
| |
12.1 | 74 | [[image:attach:zert01.png||height="321" width="600"]] |
| 75 | [[image:image-20221128112923-1.png||height="321" width="600"]] |