BigFix MDM Server TLS Certificate Content

Understand the required format of the BigFix MDM Server TLS certificate for MDM Server installation.

BigFix MDM server TLS Certificate Content

The MDM Server certificate must be available in a .crt or .pem format, and must take the form of a certificate chain containing the following:

The actual MDM TLS certificate provided by the trusted CA
Any intermediate certificates provided by the trusted CA
The trusted CA root certificate

If the trusted CA does not provide such a chain directly, concatenate the individual .crt or .pem files into a single certificate chain and provide it as the MDM Server’s TLS certificate during MDM Server installation.

The following command is an example for concatenating certificates on Linux:

cat <server TLS .crt> [intermediate .crt] <CA root .crt> > mdmserver.crt

This may require additional action on one or more files provided by a trusted CA to extract the various certificates and keys needed to build the required chain.

Encrypt TLS private key

To securely store the private key used while creating the CSR for the Trusted CA TLS certificate, you must encrypt it. Do the following to encrypt the TLS private key.

Run the following command:
When using RHEL8
```
openssl rsa -des3 -in <TLSKEY>.key -out mdmserver.key
```
When using RHEL9
```
openssl rsa -des3 -in <PUSHCERTNAME>_temp.key -out <PUSHCERTNAME>.key -traditional
```
where TLSKEY is the name of the key used when originally creating the TLS Certificate CSR.
When prompted, enter the encrypted private key pass phrase of your choice.
Verify it.