Generating a self-signed TLS certificate

You can use a third-party CA-signed certificate to install HCL Local License Server (LLS) on your host machine. Alternatively, you can generate a self-signed TLS certificate by running the utility.bat/sh file supplied in the LLS installer package.

About this task

The LLS installer supports trusted third-party CA certificates and self-signed certificates.

Important:

It is recommended that you use a trusted third-party TLS certificate when deploying in production environments.
For third-party certificates, contact your local IT team.
Your usage model and risk tolerance should be considered before selecting a self-signed certificate.
The use of a self-signed certificate comes with no warranties or liabilities.

You generate a self-signed certificate by running the utility.bat/sh file and following the on-screen prompts. The generated certificate secures communication between the LLS server and connected clients.

If your organization prefers a certificate signed by a trusted Certificate Authority (CA), you can use one instead of a self-signed certificate.

Note:

OpenSSL is no longer a requirement.
Ensure that the hostname (FQDN) in the certificate matches the LLS server hostname.
Keep a backup of all certificate and key files in a secure location.

Procedure

Extract the installer package:
- On Windows, use a zip program such as WinZip or 7-Zip.
- On Linux, enter the following command:
```
tar -xvzf packageName
```

Go to the directory where the utility.bat/sh file is located.

The location depends on the installer package you downloaded.


Package	Name	Location
Native, Windows	utility.bat	<unzipped-installer-package>\utility.bat
Native, Linux	utility.sh	<unzipped-installer-package>/utility.sh
Docker, Windows	utility.bat	<unzipped-installer-package>\Windows\utility.bat
Docker, Linux	utility.sh	<unzipped-installer-package>/Linux/utility.sh

From the command line, run the utility.bat/sh file and follow the prompts.
- On Windows, run the utility.bat file.
- On Linux, enter the following commands:
```
chmod +x utility.sh
```
```
./utility.sh
```
The following menu is displayed:
```
Please choose what you want to do:

1. Generate TLS Certificate
2. Quit

Enter your choice (1-2):
```
Press 1 to generate a self-signed TLS certificate.
Enter the FQDN (Fully Qualified Domain Name), for example MYLLSSERVER.COM.
A Fully Qualified Domain Name (FQDN) is the complete address of a resource on the network (hostname + domain + sub-domain). You can obtain the FQDN as follows:

On Windows:
```
powershell "(Get-WmiObject win32_computersystem).Name + '.' + (Get-WmiObject win32_computersystem).Domain"
```
On Linux:
```
hostname -f
```
Enter your organization name: Type a name for the organization, such as HCL.
Enter certificate validity period (in days): Specify the validity period of the certificate in days. The default value is 365.

Enter the directory to store certificates: Specify a path where you want the generated certificate and key files to be stored.

The following example message indicates a successful generation:

Generating certificate files using tlsutil...

Self-signed certificate generated successfully!
Certificate and key files are located in: C:\MHS\LLS\Certificate

TLS certificate generation completed.

Do you want to generate something else?
1. Generate TLS Certificate
2. Quit

Enter your choice (1-2):

Press 2 to quit the process.

Results

The self-signed certificate is generated and saved at the provided location.

The FQDN you entered is set as both the Common Name (CN) and the Subject Alternative Name (SAN) of the generated certificate. Clients must therefore reach the server by that exact name, otherwise the connection fails with a certificate name mismatch.

You can now install HCL Local License Server using the generated certificate. See First Time Installation.