Use this page to upload an external CA issued EP Signing Certificate if the external CA generated the CSR and private key. However, it is not recommended to make this a frequent operation.
When uploading a new EP Signing Certificate, the EP Signing Certificate must be issued by an external Certificate Authority. The uploaded EP Signing Certificate must have Basic Constraints with a CA value set to true.
Uploading a new EP Signing Certificate will force all Experience Portal servers to replace their current identity certificate with a new identity certificate signed by the new externally signed EP Signing Certificate. This will happen on the next restart of the Experience Portal servers’ services.
Important:
After uploading a new EP Signing Certificate, restart the Experience Portal servers. On the EPM web interface, go to or MPP Manager, and restart the servers in the following order:
-
MPP servers
-
Auxiliary EPM servers
-
Primary EPM servers
Note:
Do not upload the EP Signing Certificate multiple times without restarting all the Experience Portal servers. This will potentially cause loss of communications between the Experience Portal servers. In case this happens, do the following to regain communication between the servers:
Note:
If you are importing an EP Signing Certificate signed by an external Certificate Authority, ensure the following:
-
The certificate must be formatted as a PKCS#12 file. A PKCS#12 file always includes a certificate and its corresponding key. The certificate is encrypted and requires a password. The PKCS#12 file must include all CA certificates.
-
The EP Signing certificate must include the standard extension Basic Constraints with the CA:true attribute. This allows the EP Signing Certificate to issue and sign identity certificates.
-
If the Extended Key Usage is specified in the X509.V3 certificate extension, specify Server Authentication (serverAuth), and Client Authentication (clientAuth) for the usage.
