[KB8587] Import the ESET Inspect Server certificate from a file during the ESET Inspect Server installation

Issue

• Requirements for the creation of ESET Inspect Server certificates in ESET PROTECT On-Prem
• Import the ESET Inspect Server certificate from a file during the ESET Inspect Server installation

Details

Solution

Requirements for the creation of ESET Inspect Server certificates in ESET PROTECT On-Prem

By default, when you create a Peer Certificate in ESET PROTECT On-Prem, the Host field is set to *, which makes the certificate’s Common Name (CN) and Subject Alternative Name (SAN) equal to a single asterisk. ESET Inspect does not support certificates where the Common Name (CN) or Subject Alternative Name (SAN) is just *. Instead, you must use the actual hostname or IP address of the ESET Inspect Server in the Host field.

Format

• Certificates must be in the PKCS #12 format. PKCS #12 is a file format for storing multiple cryptographic objects in a single file, such as certificates. Files in the PKCS #12 format usually have the .pfx or .p12 extension.
• Certification Authorities are stored in the X.509 format (that is, in files with the .der extension), which is another file format frequently used in cryptography.

Common Name (CN) and Subject Alternative Name (SAN) rules

These rules apply to the Common Name (CN) in the main certificate, the Subject Alternative Name (SAN) entries, and the Common Name (CN) and Subject Alternative Name (SAN) in any additional certificates included in the PKCS #12 file.

• Common Name (CN) and Subject Alternative Name (SAN) must include a real hostname or IP address
• Not allowed: * (just a single asterisk)
• Allowed: *.yourcompany.com or yourcompany.*.hq.com
  (Wildcards are allowed only as part of a domain name, not as the entire hostname.)

Mandatory parameters for creating a Peer Certificate

• Component: ESET Inspect Server
• Host: real IP Address of the ESET Inspect Server
  To allow connections from other networks, add multiple IP addresses or hostnames separated by a space, comma, or semicolon. Example: 192.168.20.22;10.1.183.88
• No semicolons (;) in file or folder names for certificate paths (semicolons are used as separators for multiple certificates)

Import the ESET Inspect Server certificate from a file during the ESET Inspect Server installation

1. On the first Server certificate screen in the ESET Inspect Server installer, select Import the certificate from a file and click Next.

   

2. In the Server certificate field, define the path to the file with the ESET Inspect Server Certificate (.pfx file): type or paste the path to the file or click Change to navigate to the file location and select the file manually. If required, in the Certificate password field, type the certificate password.

   

3. In the Certification Authority field, define the path to the file with the certification authority (.der file): type or paste the path to the file or click Change to navigate to the file location and select the file manually. Click Next.