I've inherited a partial installation, but I can see that the Inventory Master is listening on 8080 TCP HTTP rather than HTTPS. I need to change this, do I have to reinstall the whole Inventory 5 module or is there a way to make the change without? I can see that there is a certificate bound to tcp443 that must be doing nothing because there is no receiver there.
In order to use an SSL certificate for server authentication that has been issued with a self-signed
Certification Authority (CA) you have to add the CA to the trusted root of the Windows local machine
Certificate store. This is required due to a dependency by the HTTP.SYS Windows kernel module that
handles all the server HTTP communication. Add the CA on all servers in the Snow Inventory
infrastructure.
ADD CERTIFICATES SNAP-IN TO MMC
1. Open the Microsoft Management Console (mmc.exe).
The Microsoft Management Console requires elevation to start and can only be run as an administrator.
2. Select File|Add/Remove Snap-in… from the menu. The Add or Remove Snap-ins dialog box is opened.
3. In the Available snap-ins list, select Certificates and click Add.
4. In the Certificates snap-in dialog box,select the Computer account option.
5. Click Next.
6. In the Select Computer dialog box, select the Local computer option.
7. Click Finish.
8. Click OK to close the Add or Remove Snap-ins dialog box
IMPORT THE CERTIFICATION AUTHORITY
The following in performed in the Certificates snap-in of the Microsoft Management Console.
1. In the Console Root structure, expand the Certificates container.
2. Right-click Trusted Root Certification Authorities and select All Tasks, and then Import.
3. The Certificate Import Wizard is opened.
4. Click Next.
5. Browse to the folder where the certificate of the Certification Authority is stored and select the public key (.crt).
6. Click Next.
7. Verify that the Place all certificates in the following store check box is selected, and that Certificate Store is
set to Trusted Root Certificate Authorities.
8. Click Next.
9. Click Finish to import the certificate and close the Certificate Import Wizard.
10. The certificate is added to the Trusted Root Certificate Authorities|Certificates container.
IMPORT THE SSL CERTIFICATE
The following in performed in the Certificates snap-in of the Microsoft Management Console.
1. In the Console Root structure, right-click Personal and select All Tasks, and then Import.
2. The Certificate Import Wizard opens.
3. Click Next.
4. Browse to the folder where the certificate is stored and select the archive file (.pfx) that contains the public
key and the password.
5. Click Next.
6. Type the Password of the public key.
7. Click Next.
8. Verify that the Place all certificates in the following store option is selected, and that Certificate Store is set to
Personal.
9. Click Next.
10. Click Finish to import the certificate and close the Certificate Import Wizard.
11. The certificate is added to the Personal|Certificates container.
12. Close the Microsoft Management Console.
Thanks very much that was great. I had already added the root and intermediates of the gateway to the certificate store of the master . I've reinstalled the Master Service successfully, and I can see it from the gateway over HTTPS using Internet Explorer (with no certificate errors), but the gateway installation won't let me complete the installation of the server settings. I've issued a client certificate for the gateway which is accepted by the installation, and I know the forwarding URL is correct because I copied it to/from IE and it works as mentioned above. Is there some requirement for a client certificate beyond what IE would require?
No particular requirement
The certificate chain must be trusted by the computers on which the agents are run. Best practice is to have the server-side certificate signed by a trusted third-party Certificate Authority (CA).
Thanks Gigi, I think that's not needed for us as we're only collecting inventory while devices are local. I've opened a ticket for this, I would expect the Windows CA to be perfectly adequate for this application. Regards, Ian
Hello ian.dugdale,
Please find below the steps:
1. Open the Snow Inventory Configuration Manager (snowserverconfig.exe) with administrator rights which you can find in %INSTALLDIR%\Snow Software\Snow Inventory\Server
2. Remove the Master Server Instance (This will not remove the database!)
3. Re-create the Master Server Instance by adding the certificate and assign it to port 443.
The snowserver.config will still stay in %INSTALLDIR%\Snow Software\Snow Inventory\Server so the License keys can be found there.
Hope this helps.
Best,
Kadir