SSL: Complete a new certificate request using a Qumulo-generated CSR

REQUIREMENTS

Admin privileges for your Qumulo cluster
A computer with SSH and SCP clients installed
An existing CSR generated by Qumulo (see SSL: Generate a Certificate Signing Request for details)
A Windows CA

DETAILS

While Qumulo clusters come with a self-signed SSL certificate installed that will enable traffic to be encrypted for your browser sessions, the certificate will still trigger an untrusted or self-signed certificate error in a modern web browser until it has been validated by a Certificate Authority (CA). To avoid this error, you must first generate a Certificate Signing Request (CSR); see SSL: Generate a Certificate Signing Request for instructions to do so.

Once you’ve generated your CSR, you must submit the generated certificate to your CA following the steps detailed in this article. Note that these steps must be executed while logged in as a system administrator.

Open the Start menu and type cmd to open a command prompt on your Windows CA.
Use the following code to append a certificate template to your CSR with the certreq.exe tool.
NOTE: This is necessary because the Windows Certificate Authority requires the certificate to serve a purpose or else the signing request will be unsuccessful.
```
C:\>Certreq.exe -attrib "CertificateTemplate:WebServer" -submit Cluster-name.csr
```
Save the CSR back to its original location with the same name.
Reopen the Start menu and type iis to access the Internet Information Services (IIS) Manager.
Double-click the Server Certificates link in the IIS section.
Click Complete Certificate Request in the Actions pane.
When are you are redirected to the File Explorer (as seen below), change the drop-down to expose all file types (*.*).
Select the saved CSR from Step 3.
Open the Start menu and type mmc to access the Microsoft Management Console (MMC).
Click File > Add/Remove Snap-in... to open the Certificates MMC snap-in.
Select Local Computer and navigate to Personal Certificates.
Browse to your new certificate and right-click it.
Select Export... under All Tasks.
Make selections in the Certificate Export Wizard as shown in the image below:
Copy the .p7b cert bundle created by the export process to a local Qumulo directory using WinSCP.
SSH into the Qumulo node and convert the .p7b cert bundle to .pem format using the following command:
```
root@qumulo-1:~# openssl pkcs7 -in mybundle.p7b -inform DER -print_certs -out cert.pem
```
Finally, load the certificate using the qq CLI with the following command:
```
root@qumulo-1:~# qq ssl_modify_certificate -c cert.pem -k my.key.insecure
```