An SSL (Secure Sockets Layer) certificate is a digital certificate that authenticates a website's identity and enables an encrypted connection between a web server and a web browser. The SCM installer automatically creates and installs a self-signed certificate named SCMCertificate in order to provide a secure browsing experience.
About the SCM Certificate
This certificate is primarily used for:
- Encrypting and decrypting passwords.
- Generating hash values to ensure the integrity of SCM packets.
Without this certificate, the SCM application will not function as intended. However, if necessary you can replace this default certificate with any existing certificate of your choice after the installation of the SCM application.
When you need to change the "SCMCertificate"?
Packet Functionality:
When importing a packet generated by a different SCM application, the same certificate that is used to create the packet must be present in the server where the packet is being imported.
For example, if you generate a packet (P1) on a Server (Serv1) using the default SCMCertificate with a thumbprint (thumbprint1), you must ensure that Serv2, where you want to import P1, also has a certificate with the same thumbprint (thumbprint1) installed.
If Serv2 uses a different certificate with a different thumbprint (thumbprint2), you’ll need to install the SCMCertificate from Serv1 (having thumbprint1) onto Serv2 and configure the SCM application accordingly.
Self-signed certificate:
You may wish to replace the default self-signed certificate with another SSL certificate (either a pre-existing Certificate Authority (CA) certificate or a different self-signed certificate). Below is the procedure to manually configure or replace the certificate after the SCM application installation.
Replacing the SCMCertificate with an Existing Certificate
In order to ensure that your SCM application operates correctly across different servers and environments, you must follow the following steps to replace the default "SCMCertificate" with an existing certificate. To replace the SCMCertificate with an existing certificate, complete the following steps:
- Identify the pre-existing or self-signed certificate that will replace the
default "SCMCertificate".Note:
- Ensure that the selected certificate has both public and private keys associated with it.
- Ensure that the user account running the Application Pool has the necessary permissions to access both the public and private keys of the SSL certificate.
- Navigate to and select the name of the server.
- Double-click Server Certificates.
- In the Server Certificates area, select the relevant certificate and double-click it to open the Certificate dialog box.
- Click the Details tab and copy the
Thumbprint value.Note: This thumbprint is required for configuring the web.config file.
- Navigate to the SCM installation directory and open the web.config file in Administrator mode using any text editor.
- Locate the CertificateHash key and paste the copied thumbprint value to replace the existing thumbprint.
- Clear the old password values by removing the old entries for the
PICEncPassword and
SCMEncPassword keys as follows:
- <add key="PICEncPassword" value="" />
- <add key="SCMEncPassword" value="" />
- Modify the connection strings by replacing the placeholder ***** with the appropriate passwords for BIC and SCM in plain text.
- Click Save and Apply.
- Save the updated web.config file.
- Restart IIS for the changes to take effect.
- Log on to SCM.
- Upon successful login, the previously stored passwords will be encrypted in the PICEncPassword and SCMEncPassword sections of the web.config file.
- When you replace the default SCMCertificate with a new certificate, it is essential to ensure that the SCM application can read both the private and public keys of the new certificate. This requires setting the appropriate permissions for the SCM Pool user and ensuring that the application has access to both keys.
- If you modify the CertificateHash manually, ensure to update any stored passwords in the Manage Database Connections section within the SCM application.
Manage User Account Permissions for certificates other than SCMCertificate
The SCM Pool user must have at least read permission to both the private and public keys of the certificate to access the SCMCertificate. If you are using the default SCMCertificate created by the SCM installer, the read permission is automatically configured. However, if you replace the default certificate with a different one, you must manually assign the appropriate permissions to the SCM Pool user.
To configure permissions for the SCM Pool user to access the private and public keys of the SSL certificate, refer to the Manage User Account Permissions for SSL Certificate topic.
By following these steps, you ensure that the SCM Pool user has the necessary permissions to access the private key of the new certificate (replaced SCMCertificate). This step is crucial for the proper functioning of the SCM application after replacing the default certificate.
If you replaced the default certificate and did not set the correct permissions, you might encounter issues with accessing encrypted passwords or other secured functionality in the SCM application. By granting the appropriate permissions, these issues can be avoided.
Fixing Issues with Old Passwords after modifying the CertificateHash
When you manually modify the CertificateHash in the web.config file, the previously encrypted passwords stored in the SCM database cannot be decrypted by the new certificate. This issue typically arises when connection strings that were saved using an old certificate cause errors due to the certificate change.
To resolve the issue with old passwords, complete the following steps:
- Identify Affected Connection Strings.
- In the SCM application, navigate to the Manage Connection
screen. Note: This process needs to be repeated once for each connection string.
- Under Manage Database Connection Settings, select the connection string that is using the old password and click Edit.
- Enter the current password for the connection that is encrypted with the old certificate.
- Click Test Connection to ensure that the connection is successful.
- If the connection test is successful, click Update to
save the updated password and connection settings. This enables SCM to
re-encrypt the password using the new certificate.Note: Follow the same process for all other existing connections and passwords that were encrypted with the old certificate. This ensures that all connection strings are updated and can be decrypted properly with the new certificate.
Once you update and save the passwords for the affected connection strings, SCM stores the passwords encrypted with the new SCMCertificate. After this, all connections work seamlessly with the new certificate.
You only need to update the old passwords once, after which the system continues using the updated encrypted values.
Configuring http
By default, the SCM application is configured to use HTTPS for secure connections. If you attempt to use HTTP, the connection will fail, and an error will appear in the trace.log.
However, if you need to use HTTP instead of HTTPS, complete the following steps:
- In the web.config file, under the httpcookies node in the system.web section, set the requireSSL attribute to false: <httpCookies requireSSL="false" />
- Under the authentication section in the forms node, set the requireSSL attribute to false: <forms requireSSL="false" />