Steps to Create a Security Certificate

WSS requires that the browser has a root certificate of authority (CA) to communicate securely to another (server) process which uses a server side certificate compatible with the CA. The following is an example on how to create the certificates using OpenSSL.

Ranger Remote versions 2.2.3.0 and above will no longer allow certificates created with 1024-bit RSA keys. This would invalidate all certificates created with SBT's CreateWindowsCertificate (attached in this article) prior to the October 2024 update. If you are using Ranger Remote 2.2.3.0 or above, please re-create the relevant certificates using the steps described below.

Apple's Safari is moving to a 398 day certificate expiration policy effective September 1, 2020. Any two-year certificates created before August 31st will still work until their issued expiration date.

Step 1: Download and Install OpenSSL

If you do not already have an OpenSSL installation on your workstation, you can find a download link here.

Link: https://slproweb.com/products/Win32OpenSSL.html

Alternative link for OpenSSL binaries: https://wiki.openssl.org/index.php/Binaries

We recommend installing the 32bit full version (although 64 bit OpenSSL installation should also work fine for our purposes since the certificates are architecture agnostic. You do not need to switch to 32bit version, if you already have a 64 bit installation on your workstation).

During the installation, feel free to select Copy OpenSSL dlls to Windows System Directory option.

Note for OSX: OpenSSL might be installed on MacOS workstations by default.

Step 2: Download Attachment: OpenSSLCreateCertWinMacV2

You can find the attachment at the bottom of this page. Please download and extract the contents of this folder. The zip file should have the following 4 files in the same directory

openssl.cnf
createWindowsCertificate.bat (for Windows)
createfilesMac.sh (for Mac)
v3.ext

Step 3: Edit the CNF File with Your Organizational Information.

.cnf file in this package is the configuration file. Both scripts use the .cnf file to create the certificates with the specified configurations.
The .cnf file included in this package is provided as an example. If you want to create your own .cnf file or if you already have one that you use, feel free to replace it.
If you decided to use the example .cnf file provided in this package, it is crucial that you edit the file with the correct organizational information.
The section under [ req_distinguished_name ] should always reflect your current information, and the default SBT values should not be used. All other sections can remain the same, or further edited based on your organizational needs.

Step 4: Run the Appropriate Script:

For Mac/OSX, createFiles.sh
For Windows, createWindowsCertificate.bat (double click should be enough)
After running the script, you should see the relevant files created within the same directory. For Ranger Remote WSS connection, you will need the following files.:

Server.pem
RootCA.pem

please save these files for future use/reference.

Step 5: Installing Ranger Remote

Once you obtain your certificates, all you need to do is to put them in the same directory as the Ranger Remote installer that you have and then run the installer. During the installation, if you select the WSS installation option, the Remote installer will detect the two .pem files and correctly configure service and browser settings using the certificates.

Ranger^® - The universal check scanner interface