Manage SSL/TLS Certificates & CSRs in Mideye

Mideye Server 6.2.8 and forward provides enhanced Certificate Management with support for CSR generation with existing key.

Mideye Server uses certificates for connections to the Central system, LDAPS/TLS, and the WebGUI. During the initial installation, a self-signed certificate is generated for the WebGUI.

The WebGUI certificate or LDAPS CA certificates can be imported into the Mideye Server using the Certificate Management tool.

Certificate Management enables the management of:

• LDAPS binding when using an encrypted connection to a configured LDAP server, such as Active Directory.
• The certificate for the Mideye WebGUI.

To access Certificate Management, navigate to Server Settings → Certificate Management. An overview of all imported and fetched certificates will be displayed.

---

Import a new certificate

To import a new certificate, click on “Actions…” and select the appropriate import method based on the certificate you need to import.

The Actions menu provides four options:

Option	Purpose
Import LDAPS/CA Certificate	Import a trusted CA or LDAPS certificate
Import Web Admin KeyStore	Replace the Web Admin certificate with a .p12/.pfx keystore
Generate Web Admin CSR	Generate a Certificate Signing Request using the existing private key
Import Web Admin CA Reply	Import the signed CA reply after submitting a CSR

Restart required

The Web GUI certificate is loaded when the service starts. After updating the Web Admin certificate, either by keystore import or by CA reply, you must restart the Mideye Server service before the new certificate is served.

There are two ways to replace the Web Admin certificate. Which one to use depends on where the private key was generated:

• Private key generated outside Mideye Server (for example with Windows certreq, MMC, or OpenSSL): export the certificate together with its private key as a .pfx/.p12 file and use Import Web Admin KeyStore.
• CSR generated by Mideye Server: submit the CSR to your CA and use Import Web Admin CA Reply. A CA reply can only be imported for a CSR that Mideye Server itself generated.

Certificates for LDAPS and Trusted CA

When importing a new LDAPS or trusted CA certificate, ensure that the certificate is also present on the domain controller. Follow these steps to import the certificate:

1. Select “Import LDAPS/CA Certificate.”
2. Click “Choose File” and upload the desired file to the Mideye Server.
3. Optionally, check “Enter alias for certificate” to provide a custom alias. If unchecked, the Common Name (CN) of the certificate is used as the alias.
4. Click “Import.”
5. The certificate will now appear in Certificate Management.
6. Navigate to the LDAP profile and test the connection.

Note

Allowed certificate formats for LDAPS are: .der, .cer, .pem, and .crt.

Certificate import for Web Admin

Use this method when the private key was generated outside Mideye Server, for example a .pfx file exported from a Windows certificate store.

1. Select “Import Web Admin KeyStore.”
2. Click “Choose File” and upload the file to the Mideye Server.
3. Enter the password for the certificate keystore file.
4. Click “Import.”
5. The certificate will now appear in “Certificate Management.”
6. Restart the Mideye Server service.
7. Open a web browser, navigate to the Mideye Web GUI, and verify that the correct certificate is being used.

Note

• Allowed formats are .pfx and .p12. The keystore must contain exactly one entry (alias).
• The private key must be protected by the same password as the keystore itself. A keystore whose key entry has a different password cannot be imported.
• A certificate that has already expired is rejected.

Importing a Certificate Using a CA Reply for Web Admin

Available in Mideye Server 6.2.8 and later.

The CA reply is verified against the private key already stored on the Mideye Server, so this method only works for a CSR generated with “Generate Web Admin CSR.” A reply to a CSR created with another tool (Windows certreq, MMC, OpenSSL) is rejected with a key mismatch error. Import such certificates as a Web Admin KeyStore instead.

1. If the issuing CA chain is not already present in Certificate Management, import the root CA and any intermediate CAs using “Import LDAPS/CA Certificate.” The CA reply import builds the certificate chain from certificates already on the server and fails if the chain is incomplete.
2. Select “Generate Web Admin CSR” to create a CSR file from the Mideye Server. The CSR reuses the existing private key and is signed with SHA256withRSA. The subject and Subject Alternative Names are copied from the current Web Admin certificate.
3. Submit the CSR file to a trusted Certificate Authority (CA) for signing.
4. Once the CA has signed the CSR, they will send back the CSR reply.
5. Select “Import Web Admin CA Reply” from the Actions menu.
6. Click “Choose File” and upload the CA reply file.
7. Click “Import.” The imported CSR reply will replace the existing Web Admin Certificate.
8. Restart the Mideye Server service.
9. Navigate to the Certificate Management section on the Mideye Server to verify that the Web Admin Certificate has been updated.

Note

Allowed certificate formats for CSR reply import are: .der, .cer, .pem, and .crt.

---

Monitoring certificate expiry

The expiry dates of imported certificates are monitored in two ways:

• Dashboard status badge: Certificates are shown as EXPIRING on the Web GUI dashboard starting 90 days before expiry.
• Log file warnings: A scheduled check runs daily at 08:00 server time and writes a warning to the server log for every certificate that has expired or expires within the next 14 days.

---

Troubleshooting

Resolving the Wrong Certificate Issue in the Web Browser

User provided certificate alias is available in Mideye Server 6.0.2 and later.

If the incorrect certificate is being used in your web browser, follow these steps to select the correct certificate from the Mideye Server keystore:

1. Log in to the Web GUI.
2. Navigate to “Server Settings” → “Certificate Management.”
3. Click on the desired certificate and take note of its “Alias.”
4. Access the server where the Mideye Server is installed.
5. Open the configuration file using a text editor at the appropriate path:
   • Windows: C:\Program Files (x86)\Mideye Server 6\config\application-prod.yml
   • Linux: /opt/mideyeserver6/config/application-prod.yml
6. Add the “Alias” string from step 3 to the key-alias entry in the configuration file. For example, if the alias is webadmin and it ends with a 0 (e.g., webadmin0), remove the 0.
7. Restart the Mideye Server service to apply the changes.

Example configuration file:

server:
  port: 8443
  ssl:
    key-store: C:\Program Files (x86)\Mideye Server 6\config\keystore.pfx
    key-store-password: "123456789"
    enabled: true
    key-alias: webadmin
  compression:
    enabled: true
    mime-types: text/html,text/xml,text/plain,text/css, application/javascript, application/json
    min-response-size: 1024