Add Protocol Signed with airSlate SignNow

Add protocol signed

welcome to lab miss calm in our last video we have shown you how to register an ice node using a self-signed certificate and we first one mentioned that the node we need to have every other node certificate install which may not work well in a large deployment so in this video we'll show you an alternative of registering a node using an assigned certificate by a trusted root CA so this way each nodes only need to have its own certificate and the boot CA certificate install in addition your eyes nodes will automatically be trusted by the clients as long as those clients trust the same root CA so in our lab topology here which is exactly the same topology as a last video we have a is one that has been set up as an admin muttering node and we are trying to register the second node which is going to be a policy service node so each of these will have its own certificate signed by a root CA running on the window 2008 machine and they'll basically get to trust each other okay so here is our interface of ice one and we only have the administration and muttering boxes checked and is currently acting as the primary node okay as we mentioned the last video we need to make sure before we start that the name of the ice notes are resolvable by DNS so let's make sure that we can ping LM ice one let's melt a Sally -2 and we want to make sure the version they are matching on both nodes so here we have 1 1 1 2 6 8 and on the second node we also have 1 1 1 2 6 8 okay now to get started with our certificates we need to generate a certificate signing request so here you go to certificates local certificates there we go add and there's an option for generate certificate signing request then we currently on is one okay so for the certificate subject is very important that for the cn you need to make sure the put in the fully qualified domain name which in this case is alum - eyes e1 dot clap minutes calm and we're going to have oh you equal to call I T 0 equal lab minutes s equals CA and C equal us key link would leave at default 2048 with sha-256 let me copy that so we can reuse that on the eyes too okay so submit okay so I said the CSR was generated so let's go to eyes - and repeat the same process and generate certificate signing request okay copy and paste what we had earlier but get a change to see n equal LM IC 2 and then submit okay now we're going to have to export the CSR so here a nice one export safe and let's call that LM - is c11 CSR save and then we can have to export the CSR belongs to is - as well here save LM - + E to scroll CSR okay so those should be saved by now desktop here now we're going to have to have this sign by L root CA let's bring up a notepad okay and now we're going to have to go to Oh window 2008 certificate server so the IP is once 1916 30 2.40 first last cert SRV and we're going to lock in as administrator okay so we also need to download the the root CA self-signed cert so we can tell the two nodes to trust it to receive looks like we haven't downloaded it so we're just going to use the same name Allen root CA so overwrite that lets go back and then we're going to make a certificate request with the advanced certificate with base64-encoded and that's basically what we have here on our notepad so it's just a copy and paste and let's give it the use of web server template okay now I'm going to download certificate that's been sign say we'll call them LM I see one cert okay I'm just going to go back and then do the same thing for I see two using web server submit download the cert all right so we have both certs on a desktop just a quick look here is au fqdn in full has been signed by all the root CA okay so now we're going to have to go ahead and install the certificate so let's start off with importing the boot CA to the certificate store you can see this is from the previous video we can go ahead and delete that there was a self signed certificate from ice too so now we're going to have to import a boot certificate and Cal MLM fruit CA and if you want to use that to verify your client indication by certificate let's make sure you have that box checked and especially if you do the authentication like ETLs you want to make sure you have that box checked okay same thing you should tip gets door you can delete the ice once outside sir import browse friendly name LM root CA I'm going to trust to search for client indication and submit alright so the next thing we need to do is to bind the certificate that was signed by the root CA to the previously generated CSR so we do that is go to your local certificates and add and there's an option for buying CA certificate and we're going to select LM is e1 cert so I call it the same name and if you want to use this as part of your ETLs authentication yes and we also want to make sure we are using this for management purposes if you need to register the subsequent notes so we'll go submit case from here the box will be restarting ok so let the first box restart and now on the ice to your local certificate I'm going to bind CA certificate and here we select ala - E - cert okay use for client indication use for management purposes as this goodness is going to cause an application restart acknowledge that and then submit ok and now the system will restart okay so now we're just going to let the two notes to application to restart so let me pause the video and now come back when once the application is back up okay so now both notes are back up if we check the server certificate the browser sees with view certificate here you see the certificate now has become the one that we just install so alum Allium is e1 and on the second node we have also alum is e2 that's been signed by autumn boot CA okay so now we can proceed registering the second node as a policy service node to the primary so the procedures here is pretty much the same now with the using a self-signed certificate so go registered which is your eyes node give it an IP user name admin and the password okay now we uncheck administration we uncheck monitoring and I already have the node group previously created so we just choose alum group one okay I'll click Submit okay now it said the note has register successfully but it's still in the singing progress the state so let's refresh since this is going to take up more minutes lets me pause the video one more time now be right back okay so now the synchronization process has completed right here where it's a complete and sync completed for the status again just to make a quick note here when you log into the the second node the options the main options is much more limited and that's because you're supposed to make all the changes configure some changes on the primary node okay so if this if you are in the situation where you have to deal with let's say six notes deployment and if you were to choose the self-signed certificate that method then you need to install for example for each node in today's install five other certificates so they're all can be trusted as opposed to if you were to do a c assign certificates each of these will have its own certificate and have it signed by the CA so it has to do is just to have the own its own certificate install and the root CA certificate so it's just basically two certificate prayer notes which is much better than having to import five different certificate in a six note deployment but again with the certificate install you need to have the PKI setup which might be additional work okay so that wraps up our video on ice' note registration using a CA signed certificate thank you for watching lab INSCOM i'll see you guys in the next video