Use an existing trusted IIS certificate

If your organization's intranet is served by Internet Information Server (Windows), Apache (Linux), or another web server, you might be able to use the trusted IIS certificate for PaperCut NG/MF.

You can use an existing trusted IIS certificate if either:

• your intranet server and PaperCut NG/MF Application server run on the same server, that is, they have the same server name and address

• you have a wild-card certificate that allows arbitrary subdomains under the domain name (for example, myschool.edu) for which it was issued

To use existing trusted IIS certificate:

• Export the existing trusted IIS certificate

• Import the existing trusted IIS certificate into the PaperCut NG/MF keystore

• Configure the PaperCut NG/MF keystore

Step 1: Export the existing trusted IIS certificate

To export your trusted certificate:

1. Open the Windows management console.

2. Select your IIS server.

3. Navigate to the Windows Start menu.

4. Right-click the Command Prompt.

5. Select Run as administrator.

6. Run the following command:

   MMC

7. Verify that the Console Root screen is displayed:
   

   

8. On the Console Root screen, press the keyboard shortcut Ctrl+M.

9. Verify that the Add or Remove Snap-ins screen is displayed:

   

10. On the Add or Remove Snap-ins screen’s Available snap-ins list, select Certificates; click Add:

    

11. From the Certificates snap-in screen, select Computer account; click Next>:

    

12. Click Finish:

    

13. Verify that on the Add or Remove Snap-ins screen’s Selected snap-ins list, Console Root > Certificates is displayed:

    

14. Click OK.

15. On the Console Root screen, navigate to: Console Root > Certificates > Personal > Certificates:

    

16. Right click the certificate and navigate to: All Tasks > Export…:

    

17. Follow the Certificate Export Wizard’s prompts:

    1. Click Next:

       

    2. Select Yes, export the private key; click Next:

       

    3. Select Personal Information Exchange, Include all certificates in the certification path if possible and Enable certificate privacy; click Next:

       

    4. Select Password; then enter the export password; then click Next.

       IMPORTANT

       When importing the certificate use this same password as the source keystore password.

       

    5. Click Browse:

       

    6. Select the directory in which the certificate will be exported to:

       

    7. Enter the File name that the certificate will be exported as, in the directory you selected; click Save:

       

    8. Verify that the File name displays the path of directory you selected and the file name of the certificate that you specified; click Next:

       

    9. Click Finish:

       

    10. Click OK:

        

18. Close the Find Certificates screen.

19. Close the Console Root screen.

20. Click No:

    

Step 2: Import the existing trusted IIS certificate into the PaperCut NG/MF keystore

To import your trusted certificate into the PaperCut NG/MF keystore:

1. Navigate to the directory where your exported certificate is saved and copy the certificate.

2. Navigate to the following path on your PaperCut NG/MF Application ServerAn Application Server is the primary server program responsible for providing the PaperCut user interface, storing data, and providing services to users. PaperCut uses the Application Server to manage user and account information, manage printers, calculate print costs, provide a web browser interface to administrators and end users, and much more. and paste the certificate in this path:

   [app-path]\server\custom\

3. Right-click the Command Prompt.

4. Select Run as administrator.

5. Run the following command:

   [app-path]/runtime/jre/bin

6. On the directory, delete any existing files with the following name:

   my-ssl-keystore

7. On the Command Prompt, run the following command:

   keytool -importkeystore -srckeystore "[app-path]\server\custom\MySslExportCert.pfx" -srcstoretype pkcs12 -destkeystore "[app-path]\server\custom\my-ssl-keystore"

8. Enter the following responses to the SSL keyIn typical public key infrastructure (PKI) arrangements, a digital signature from a certificate authority (CA) attests that a particular public key certificate is valid (i.e., contains correct information). An SSL key can be either a public key (can be disseminated publicly) or a private key (known only to the owner).:

   Enter destination keystore password: Enter keystore password.

   Re-enter new password: Re-enter the same keystore password.

   Enter source keystore password: Enter the same password as entered while exporting the certificate on the Certificate Export Password screen.

   For example:

   keytool -importkeystore -srckeystore "c:\Program Files\PaperCut NG/MF\server\custom\MySslExportCert.pfx" -srcstoretype pkcs12 -destkeystore "c:\Program Files\PaperCut NG/MF\server\custom\my-ssl-keystore"

   

Step 3: Configure the PaperCut NG/MF keystore