Skip to main content

​
Overview

The Aviatrix Controller uses a self-signed certificate by default, which causes browsers to display the Controller UI as Not Secure. To remove the warning and strengthen the security of the Controller, replace the default certificate with one issued by a trusted Certificate Authority (CA). You have two methods to install a signed certificate:
  • Generate a Certificate Signing Request (CSR) and upload the signed certificate. This is the preferred method because the private key never leaves the Controller.
  • Upload a certificate with its private key. Use this method when you must generate the key pair outside the Controller.
You can also change the certificate domain used by the Controller and its gateways.
All certificates and keys must be in PEM format. File names must not contain spaces or special characters.

​
Prerequisites

  • Administrator access to CoPilot.
  • A trusted Certificate Authority that can issue a signed certificate for the Controller’s Fully Qualified Domain Name (FQDN).
  • For the key-upload method, a workstation with openssl installed.

​
Generate a Certificate Signing Request and Upload the Certificate

Use this method to let the Controller generate the private key and CSR. You then submit the CSR to your CA and upload the signed certificate back to the Controller.
1

Open the Controller Certificate card

  1. In CoPilot, go to Settings > Configuration > General.
  2. Locate the Controller Certificate card.
  3. Click Upload Certificate.
  4. Select Generate Certificate Signing Request and Upload Certificate.
2

Generate the CSR

Under Step 1: Generate Request:
  1. In Fully Qualified Domain Name, enter the Controller’s FQDN.
  2. Click Download Request to generate and download the CSR file to your local system.
3

Obtain the signed certificates

Submit the CSR to your trusted Certificate Authority. Wait for the CA to return a signed CA Certificate and Server Public Certificate in PEM format.
4

Upload the signed certificates

  1. Return to Settings > Configuration > General and open the Controller Certificate card.
  2. Click Upload Certificate.
  3. Select Generate Certificate Signing Request and Upload Certificate.
  4. Under Step 2: Upload Certificate, click Select next to CA Certificate and choose the CA certificate file. Repeat for Server Public Certificate.
  5. Click Upload.

​
Upload a Certificate with a Key

Use this method when you must generate the private key and CSR outside the Controller.
1

Open the Controller Certificate card

  1. In CoPilot, go to Settings > Configuration > General.
  2. Locate the Controller Certificate card.
  3. Click Upload Certificate.
  4. Select Upload Certificate with Key.
2

Generate the private key

On a Linux or macOS workstation, run:
3

Generate the CSR

Create the CSR from the private key:
Leave the challenge password blank when prompted.
4

Obtain the signed certificates

Submit the CSR to your trusted Certificate Authority. Wait for the CA to return a signed CA Certificate and Server Public Certificate in PEM format.
5

Upload the certificate bundle

  1. Return to Settings > Configuration > General and open the Controller Certificate card.
  2. Click Upload Certificate.
  3. Select Upload Certificate with Key.
  4. Click Select next to each of the following and choose the corresponding file:
    • CA Certificate
    • Server Public Certificate
    • Server Private Key (my_priv.key)
  5. Click Upload.

​
Change the Certificate Domain

Changing the certificate domain regenerates certificates for the Controller and all managed gateways.
Changing the certificate domain disconnects all logged-in users. Perform this change only when your security requirements require it, and schedule the change during a maintenance window.
1

Open the Certificate Domain tile

In CoPilot, go to Settings > Configuration > General and locate the Certificate Domain tile.
2

Enter the new certificate domain

  1. In the Certificate Domain textbox, enter the certificate domain you want to use. To revert to the default, click Reset To Default.
  2. Click Save.
3

Confirm and apply

  1. Select I understand the implications of changing the certificate domain.
  2. Click Change.