How to replace the Default UI Certificate with a Customer CA-Signed Certificate

Issue:

How to Replace the Default UI Certificate with a Customer CA-Signed Certificate

Use this procedure to replace the default self-signed UI certificate with a server certificate signed by your CA.

Product:

PowerChute Network Advanced

Environment:

PowerChute Network Advanced UI on a Windows OS

Cause:

Informational

Solution:

Scope:

• Applies to PowerChute Network Advanced Configuration Tool service deployments.
• Assumes you already have your CA certificate and CA private key.

Prerequisites:
1. OpenSSL is installed on the machine where you will generate certificates.
2. You have:

• CA certificate file
• CA private key file

3. You know the server DNS name and, if needed, the server IP address.
4. You have administrator access on the PCNA host.

Procedure:

1. Create a working folder for certificate artifacts, for example:

Open a command prompt with elevated privileges and enter the commands

mkdir certs

cd certs

2. Create a SAN config file with a test editor named pcna-server.cfg with content like:

[v3_ca]

subjectAltName = @alt_names

[alt_names]

DNS.1 = pcna-server.powerchute.local

IP.1 = 192.168.1.1

3. Generate a private key and CSR:

openssl req -newkey rsa:4096 -sha256 -nodes -keyout pcna-server-key.pem -out pcna-server-csr.pem -subj "/CN=pcna-server.powerchute.local"

4. Sign the CSR using your CA to create the server certificate:

openssl x509 -req -set_serial 01 -days 365 -in pcna-server-csr.pem -out pcna-server-cert.pem -CA ca-cert.pem -CAkey ca-key.pem -extensions v3_ca -extfile pcna-server.cfg -sha256

5. Build a PKCS#12 keystore with the required alias:

openssl pkcs12 -export -out pcnakeystore.p12 -inkey pcna-server-key.pem -in pcna-server-cert.pem -certfile ca-cert.pem -name pcna-server

6. During the export prompt, enter the keystore password expected by PCNA SSL configuration.

7. Copy the new pcnakeystore.p12 to the machine running PCNA.

8. Stop the PCNA service from Services or with:

net stop pcna

9. Replace the existing keystore file with the new pcnakeystore.p12.

10. Start the service:

net start pcna

11. Verify the UI now presents the new CA-signed certificate.

Validation Checklist:
1. Certificate Subject CN matches your server name.
2. SAN contains the DNS and/or IP used by clients.
3. Certificate chain includes your issuing CA.
4. Alias inside the p12 is exactly pcna-server.
5. Browser shows the newly issued certificate after service restart.

Notes
1. If required, include Organization and OU in CSR subject, for example:

-subj "/CN=pcna-server.powerchute.local/O=your-organization/OU=your-org-unit"

2. The keystore filename must be pcnakeystore.p12.
3. The certificate alias must be pcna-server.
4. The export password in Step 5 must match the password configured for the PCNA SSL keystore.
5. If the password does not match, the service may not start, or HTTPS may not initialize.

Released for: Schneider Electric Indonesia