1

This is a brief how-to on how to secure your Openfire server with an SSL certificate. This is what worked for me in a recent installation. My cert was obtained from Comodo as they offer free certs to Non-profits like the one I work for.

Step 1: Download and Install OpenSSL-Win32

Windows binary can be located here.

Win32/Win64 OpenSSL Installer for Windows - Shining Light Productions

Step 2: Generate a Private Key

Open a command prompt and navigate to your OpenSSL\bin folder.

Command: openssl genrsa -out your.domain.com.key 2048

Step 3: Generate CSR

openssl req -out your.domain.com.csr -key your.domain.com.key -new

Step 4: Fill out Information

Fill in the prompted fields (State, Locality, ON, OU) For the common name, make sure to put your domain that you are trying to secure. For a wildcard, use *.domain.com

You can leave the rest blank after that.

Step 5: Copy CSR

In the bin folder you will now see a file for your csr and one for you private key. Copy the contents of the CSR and paste it into your SSL provder CSR request form.

Step 6: Configure your Cert

Once your receive your cert from the vendor. Open your .crt file. You should also have a .bundle file. Copy the contents of the .bundle file and paste it directly beneath the contents of your .crt file. Save it as a new file. Something like fullcert.txt

Step 7: Update Information

Login to your openfire console. Browse to Server settings and then Server certificates. At the bottom you should see a place to update the CSR issue information. Update that with the same information you used to generate the CSR in openSSL

Step 8: Insert the Cert

Once the information is updated, click the Import button that is right above the self-signed certificates in Openfire. This will take you to a import form.

The passphrase by default should be changeit

In the second field, copy the contents of the .key file we created in OpenSSL that should be in the bin folder and paste it there.

In the third field, copy the contents of the fullcert.txt file we made and paste there. Hit save and your cert should import. Restart openfire.

This is a general how-to on the subject matter. A few other things you may need to do: insert root and intermediate certificated depending on your CA. This can be done in the java keytool.

I did not delete the self-signed certificate but it should not cause an issue if they are removed.

4 Spice ups