How To Enable Self-Signed Support for Dell Manager in Dell Encryption

Affected Products:

• Dell Encryption
• Dell Data Protection | Encryption

Dell Encryption software uses a Self-Signed Certificate for its Java-based components. Self-Signed Certificates are not required to implement Dell Encryption to the network.

Information about Self-Signed Certificate

Dell Technologies recommends a self-signed certificate only in a nonproduction environment. If your organization requires an SSL server certificate, or you must create a certificate for other reasons, see the Dell Data Protection | Edition Enterprise Installation and Migration Guide section on Create a Self-Signed Certificate Using Keytool and Generate a Certificate Signing Request that section describes the process to create a java keystore using the Keytool.

Server Configuration to allow Self-Signed Dell Manager Certificates

1. Stop the Dell Core and Dell Compatibility Server Services.
2. Open the Certificates Management Console for the Local Computer and export the self-signed certificate to a PFX file.
   Note: The certificate to export is in the Local Computer\Personal\Certificates keystore in the MMC.
3. Open the Server Configuration Tool.
4. Click the Settings Tab and Check Disable Trust Chain Check.
   Note: Disabling this trust chain check is to disable the check before signing of the policy bundle. This is not related to SSL.
5. Click Actions > Import DM Certificate then proceed through the wizard to locate the PFX file you created in step 2 and import it into the database.
6. You may have to test the database configuration for this option to be usable.
   Note: In previous versions of the Dell Data Protection Server, if a certificate that was bad (for example, not having a private key available), then the new certificates would be inserted into the database table SigningCertificate, and the original row would be kept. This would cause issues because the Core Server would begin at the first row and then traverse the table, running into the bad certificate again. In the later versions of the Dell Data Protection Server, the row is replaced, eliminating the issue of encountering the bad certificate.
7. Restart the Dell Core, Compatibility, and Security Server Services.

Client Configuration to allow Self-Signed Certificates

1. Open the Registry as an administrator.
2. Go to the:

   HKLM\System\CurrentControlSet\Services\DellMgmtAgent\Parameters\Location

3. Create a DWORD32 Value called DisableSSLCertTrust.
4. Once the value is created set it to a value of 1
5. Restart the client.
   Note:

   • Testing of a DM policy update should be performed to verify that the certificate is in place, and the endpoint is sending and receiving policies correctly.
   • Regarding the Domain Signed Certificate Templates, you must duplicate the default Web Server certificate. Below are two links to articles created by Microsoft and they detail the steps to perform this task, which any Certificate Authority Administrator can do.

Create a New Certificate Template

Once you duplicate the template, choose the request handling tab of the duplicate template and enable the private key to be exported.

Request Handling

Once these steps have been completed, you can now publish the certificate, and once the certificate has been published it should be available to be requested.

To contact support, reference Dell Data Security International Support Phone Numbers.
Go to TechDirect to generate a technical support request online.
For additional insights and resources, join the Dell Security Community Forum.