Overview

The ssl-folder contains configuration files and scripts for HTTPS certificates, to ensure the security of the DINGO-Stack web services.

A CA (certificate authority), is an entity that issues digital certificates, signed by its root CA certificate. It acts as a trusted third party, between the owner of a certificate and the party relying upon the certificate.

The root CA certificate is already generated when the DINGO-Stack is installed. It consists of two files: the private DinGoCA.key and the public DinGoCA.pem.

Note: The script (rn_create_root_certificate.sh) that generated the root CA certificate, should not be executed, unless it is assumed that the private key has been compromised.

It could be that the user has its own root CA certificate, that it wants to use. In that case the user should follow these steps:

  1. That a backup of the existing DinGoCA.key and DinGoCA.pem files.
  2. Copy the users private key and public certificate in PEM-format to the ssl-folder.
  3. Rename the users files to DinGoCA.key and DinGoCA.pem.
  4. Restart the DINGO device.

When the DINGO device boots, it will acquire an IP-address. The boot sequence will automatically create a HTTPS certificate, based on the IP, by executing the rn_auto_create_self_signed_for_ip.sh script, within rc.local.

If the HTTPS certificate shall also be adapted to the other IP´s, like the public IP of a router, and hostnames, then they can be added to openssl.cnf.

It could be that the user has its own HTTPS certificate, that it wants to use. In that case the user should follow these steps:

  1. Copy the HTTPS certificate files (.key and .crt) to the ssl-folder. Give them distinctive names.
  2. Go to HTTP setup within the DINGO-Manager and enter the SSL certificate management.
  3. Enter the path and names of the private key and certificate file, in the fields in the bottom of the window. Then save the changes in the DINGO-Manager.
  4. Restart the DINGO device.
Example of use: The path and names of the private key and certificate file, can also be configured via the DINGO-Stack web services at this location http://some-ip-address/bacnetws/dingo-system/http-setup