From ClickShare firmware v2.12 onwards, custom HTTPS (SSL) certificates can be uploaded to the ClickShare Base Units. Using a CA-signed certificate:
- Replaces the default self-signed certificate
- Ensures compliance with enterprise security policies
- Eliminates browser privacy warnings when accessing the configurator
Important: To see if your certificate is working, you must access the Clickshare Base Unit using a Fully Qualified DNS name, otherwise, there will not be a process initiated to verify the certificate (accessing via IP will not produce the "green" or locked indication).
| Term | Description |
|---|---|
| CA | Certificate Authority (public or private) |
| CSR | Certificate Signing Request used to obtain a certificate |
Supported HTTPS SSL deployment modes
ClickShare supports two certificate approaches:
A per base unit certificate is more secure than a wildcard certificate but labor intensive for large enterprises.
Notes:
- Installing custom certificates on CS-100(H) and CSE-200/200+/800 uses a different procedure (how to: see KB2593).
- When a ClickShare Base Unit is initially configured, a private key is generated internally by the Base Unit, this is embedded in the CSR generated for the CA.
1. How to create and upload the per Base Unit custom certificate?
- Login to your ClickShare Base Unit Configuration page.
- Navigate to Security > Passwords > HTTP encryption and click Setup HTTP encryption...
- Click the radio button Create Certificate Signing Request and then click the Generate CSR button.
- Enter the required details to create a CSR:
- Domain name
- Organization (optional)
- Department / Organization Unit (optional)
- Locality / City (optional)
- State / Province (optional)
- Country (optional)
- Click Download to save the CSR file.
This CSR needs to be provided to the Certificate Authority (usually via email), the CA will return a certificate (or a list of certificates from a public CA - a public CA provider will typically include intermediate CA's) in the return email The resulting certificate needs to be uploaded to the device to activate it. See step 9 on how to use a list of certificates that come from a CA using intermediate CA authorities.
- Navigate to Security > Passwords > HTTP encryption and click Setup HTTP encryption...
- Click the radio button Use a custom certificate and then click the Upload certificate button.
- Enter your passphrase (optional) and then click Save changes to install the custom certificate on your ClickShare Base Unit.
If there are intermediate nodes in the SSL chain then place the ClickShare Base Unit as the top entry in the cert, then the intermediates, plus finally the root. Prepare the public certificates for the import.
- Place all the certificates into a single directory to make things easier
- Open the text editor of your choice
- Copy/paste all the provided certificates into this text editor
- The certificates must be in order; if the CA does not identify which certificate is the root/intermediate/BU (base unit) --> you will need to open each certificate individually using Windows certificate manager: (note, there could be multiple intermediate CA's). Look for the "Issued to" line.
Place them in this order:
-----BEGIN CERTIFICATE-----{Base Unit cert}-----END CERTIFICATE----------BEGIN CERTIFICATE-----{intermediate CA cert}-----END CERTIFICATE----------BEGIN CERTIFICATE-----{root cert}-----END CERTIFICATE-----
The ClickShare Base Unit is expecting a text file with either a .pem or .pfx extension (.pem is recommended).
Save the text file in your editor with this format. Your certificate is now ready for import. pfx is an encrypted file format requiring a password to open.
Troubleshooting secure connection issues
In some cases, the certificate may upload successfully but a secure connection is still not established. This issue can be resolved by creating a DNS A record for the ClickShare Base Unit. This will allow for a secure connection to the Base Unit via IP address.
2. How to create and upload the Wildcard custom certificate?
- If you want to use a wildcard certificate, the Clickshare Base Unit does not create this type of CSR.
- In addition to the certificate information above, a Private/Public key pair must also be generated. The Private Key is suggested to be added at the bottom of the concatenated key file). When ClickShare was initially started, it generated a private key for only itself --> this initial private key cannot be used for a wildcard certificate (Barco keeps the initial key private).
The private key will have this format:-----BEGIN PRIVATE KEY-----
{private key}
-----END PRIVATE KEY----- - Using the CSR tool of your choice, we need to generate a private key that matches a public key. The public key is embedded into the CSR to the CA. I like the one below as it generates both at the same time. To create the wildcard certificate, create the Common Name (CN) with the sub-domain you are placing the base units into. Like this example: *.clickshare.lab.com --> the star results in the wildcard certificate. The other fields are optional, however, the CA may request you complete other fields.
https://cheapsslsecurity.com/ssltools/csr-generator.php
When you tap generate CSR, both files will be presented to you. Download them both in a secure location, keep the private key in a secure location. This is the CSR you send to the CA.
If you desire a more trusted site, it is possible to use a Microsoft solution: https://stackoverflow.com/a/38363589 - The CA may ask you for a DNS txt record, this verifies you are who you say you are and sets the sub-domain for the wildcard certificate. The CA will typically ask you for a DNS text record, then ask you to change it - proving you own the domain. (similar to confirming your email address by clicking a link in an email sent to you)
- You now have the information required for a wildcard certificate that can be deployed to all ClickShare's in a specific sub-domain (assuming the CA sent you the additional certificates in email.
- Follow the same steps as above (pickup from bullet 5 downwards) to create the single text file that is uploaded to all ClickShare's in the sub-domain. Do not forget any intermediate CA's.
- See KB2549 for information related to wildcard certificates.
- To deploy the certificate on an enterprise scale, ClickShare has an embedded API.
IMPORTANT: This is a clear text key, anyone can see your private key, use a tool like https://certificatetool.com/ssl-converter/pem/pem-to-pfx to encrypt the key, DO NOT lose the password, or you will need to start again. Deploy the encrypted key. - This URL will display the active certificate on a ClickShare base unit: (you will be prompted in a pop up to enter the admin account of the ClickShare).
https://xxx.xxx.xxx.xxx:4003/v2/configuration/https
To access the API, please go to WIFI and Network/services/API of a ClickShare base unit, this will have the API documentation for your details on the API commands.
The request body of the API needs to contain the URL of the completed wildcard certificate and the encrypted password. You can use whatever method you like to distribute the key.
