1

I know this has been asked a million times and I searched forums and google but I’m still stuck on this. How do I get the SSL certificate working on spiceworks? Step-by-step with pictures would be nice.

  1. Can I install a self-signed certificate using gpo for all my users without needing to purchase an outside ssl certificate from another company? Meaning is there a free way to do this?

  2. If not, any instructions using outside source such as godaddy? Can someone recommend an outside vendor that is cheapest?

1 Spice up
2

I want to add that I’m allowing access via ssl outside of my network. Is that a no no?

3

  1. Yes, you can use self-signed certificates. You will need an internal infrastucture to to this, and the certificate clients will use will be your internal root CA certificate, not the one you choose for Spiceworks. No GPO needed, internal clients will trust certificates signed by the internal root CA.

  2. Yes, you can also use official certificates. Much less hassle, but it comes woith a price. Godaddy are pretty cheap.

By googling “spiceworks SSL” I got these answers:

http://community.spiceworks.com/how_to/2754-setup-spiceworks-to-use-a-generated-ssl-cert

http://community.spiceworks.com/how_to/93129-configure-spiceworks-to-use-ssl-or-https

http://community.spiceworks.com/topic/87739-how-to-configure-spiceworks-to-use-ssl-https-instead-of-standard-http

http://community.spiceworks.com/how_to/1490-how-to-secure-your-spiceworks-installation-using-ssl

4

I tried the first link…no bueno. Works on my server now, everywhere else I still see:

Your connection is not private

Attackers might be trying to steal your information from spiceworks.manaraacademy.org (for example, passwords, messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID

5

Someone needs to create a youtube video on this!

6

The go to article for this (IMHO) is this one:

https://community.spiceworks.com/how_to/show/3267-create-new-public-ssl-certificate-for-spiceworks

I’ve used it a couple of times to get SSL certs working for folks.

1 Spice up
7

Thank you! I was able to do it with the link you just sent. I am using a Comodo certificate. My connection uses TLS 1.0. Chrome is saying that TLS encryption 1.0 is obsolete.

  1. Is it safe to allow access to my server externally?

  2. Do you think that using the password self service will be risky to my active directory using this encryption method?

8

I can’t really answer either of those for you. Technically, external access for Spiceworks in and of itself is an unsupported configuration. Spiceworks isn’t a hardened application in any way, so it relies on the security set up around it to protect it.

If it were me, I would be hesitant at the least. At most, I wouldn’t use it. Does Comodo allow you to snag a TLS 1.2 certificate?

9

HTTPS protocols such as SSLv3 and TLS 1.0, TLS 1.1, TLS 1.2, are not actually dependent on your certificate itself. These options are actually configured on the server side. There should be a setting somewhere to restrict the protocol usage.

I am not sure how this would be done using the Spiceworks App. But it should point you in the right direction.

Chrome tags TLS1.0 as obsolete due to the recent vulnerabilities that we have seen (Poodle) with padding in TLS. So it is recommended that you disable TLS1.0. Typically in servers like Apache or Nginx, this can be done by simply modifying the SSL configuration file such as:

SSLProtocol All -SSLv2 -SSLv3 TLSv1

This config will allow all newer Protocols, while disabling the older ones.

Let me know if you have any questions or if there is any other way I can help.

10

Actually just came across this, It may also help:

http://community.spiceworks.com/topic/973058-can-tls-1-2-be-enabled

So depending on which version you are running, this might not be an option.

11

I’m completely convinced that spiceworks is not secure when exposing to the web, which is disheartening and misleading. Why is there an app to check your help desk tickets on your mobile phone? Is it just to check when your in network? Or do people actually setup vpns? What are alternative free ticket systems are there where I don’t need to worry about exposing my network data? Or can I set one server to only do tickets? Bottom line, would like external helpdesk, internal network monitoring (unless there is a way to see security externally)