 |
The Xentara Licence Server v1.0
User Manual
|
|
The Xentara Licence Server v1.0
User Manual
|
Xentara communicates with the Xentara licence server using a secure, encrypted connection, and requires a server certificate to proove its identity to Xentara. The certificate is a special certificate and must be provided and signed by by embedded ocean GmbH. A regular certificate issued by another certification authority, or a self-signed certificate, will not work.
The server certificate is accompanied by a private key. The private key of a certificate must be kept secret, and never given out to anyone. If the private key is leaked to an attacker, that attacker can impersonate the legitimate certificate holder, and the certificate is no longer of any use.
Floating licences issued by embedded ocean GmbH are tied to the private key of a particular certificate. If a certificate is renewed, the old private key will generally be reused. This eliminates the need to reissue all the floating licences. A new private key will only be issued if there is suspicion that the old key has been compromised.
The private key file should generally not be readable by anyone but the owner. Under Linux, this can be acheived by setting the file permissions to the value “0600”:
Under Windows, private key files should be placed into a directory that is only readable by the user. This is generally the case for the user’s Home directory, so placing the private key file somewhere in the user’s Home directory is normally enough.
Unless a custom path has been specified, the Xentara licence server locates the server certificate by looking for a file named xentara-licence-server.pem in the normal Xentara licence server configuration directories. The file must be located in a subdirectory named certs. By default, the following locations are tried, in order:
Linux:
Windows:
The private key belonging to the server certificate must be called xentara-licence-server.key.pem, and reside in a subdirectory named private. By default, the following locations are tried, in order:
Linux:
Windows:
The private key file must be located under the same base directory as the certificate file. If the certificate is located under ${HOME}/.config, then the private key must also be located under ${HOME}/.config, for example. You cannot place the certificate file in ${HOME}/.config and the private key file in /etc/xdg, or vice versa. The same goes for %LOCALAPPDATA% and %ProgramData% under Windows.
You can specify a different location for the certificate and private key files in the Xentara licence server config file. There are some special considerations regarding the relationship betwen the certificates and private key paths, however, as described below.
The paths of the certificate and private key files can be specified using absolute paths. If absolute paths are specified, the files are loaded from exactly those paths, and the configuration directories are not searched.
If either the certificate file path or the private key path is absolute, the other path must be absolute as well. You cannot specify an absolute certificate path and a relative private key path, or vice versa.
The paths of the certificate and private key files can be specified using relative paths. If relative paths are specified, the path is appended to each of the corresponding search directories in turn, until the file is found. If one of the files is not found, an error is emitted.
Certificate files will be searched for in a subdirectory named certs under each of the configuration directories. By default, the following directories are searched for certificate files, in order:
Linux:
Windows:
Private key files will be searched for in a subdirectory named private under each of the configuration directories. By default, the following directories are searched for private key files, in order:
Linux:
Windows:
The private key file must be located under the same base directory as the certificate file. If the certificate is located under ${HOME}/.config, then the private key must also be located under ${HOME}/.config, for example. You cannot place the certificate file in ${HOME}/.config and the private key file in /etc/xdg, or vice versa. The same goes for %LOCALAPPDATA% and %ProgramData% under Windows.
If either the certificate file path or the private key path is relative, the other path must be relative as well. You cannot specify a relative certificate path and an absolute private key path, or vice versa.