Updating SSL connection certificates

The SSL cryptographic protocol ensures data transfer security using SSL connection certificates. An SSL connection certificate (hereinafter referred to as "the certificate") is a block of data containing information about the certificate owner, the owner's public key, and the start and end dates of certificate validity.

Kaspersky Industrial CyberSecurity for Networks can use the following certificates:

• Certificates for connections between nodes of Kaspersky Industrial CyberSecurity for Networks.
• Certificates for connecting to Kaspersky Industrial CyberSecurity for Networks through the web interface.
• Certificates for connecting to Kaspersky Industrial CyberSecurity for Networks through the API.

It is recommended to update certificates in the following cases:

• Current certificates have been compromised.
• Certificates have expired.
• Certificates need to be regularly updated in accordance with the information security requirements at the enterprise.

Updating certificates for connections between nodes of Kaspersky Industrial CyberSecurity for Networks

During installation of Kaspersky Industrial CyberSecurity for Networks, certificates for connections between nodes of Kaspersky Industrial CyberSecurity for Networks are automatically updated. You can manually update these certificates without reinstalling application components.

To update certificates for connections between nodes:

1. On the computer from which the installation was performed, go to the folder containing the saved files from the distribution kit of Kaspersky Industrial CyberSecurity for Networks.
2. Enter the command for running the application installation script with the update-certs parameter:

   bash kics4net-deploy-<application version number>.bundle.sh --update-certs

3. In the SSH password and SUDO password invitations, enter the password for the user account that is used to run the installation.

Wait for completion of the script kics4net-deploy-<application version number>.bundle.sh. Upon successful completion, a success notification will appear on the screen.

The application will begin to use the updated certificates on all nodes that have installed components of Kaspersky Industrial CyberSecurity for Networks.

Updating certificates for connecting to Kaspersky Industrial CyberSecurity for Networks through the web interface

You can update certificates used for connecting to the Server through the web interface when reinstalling Kaspersky Industrial CyberSecurity for Networks. To update certificates, in the main installation menu select Change Server settings → Change Web Server certificate settings and choose one of the following certificate options:

• If you want to update self-signed certificates, enter y at the Use self-signed certificates to connect to web server prompt.
• If you want to update trusted certificates, enter y at the Use trusted certificates to connect to web server prompt and then enter the path to the file of the trusted certificate.

Certificates will be updated after reinstallation of Kaspersky Industrial CyberSecurity for Networks.

Updating certificates for connecting to Kaspersky Industrial CyberSecurity for Networks through the API

You can update certificates used for connecting to Kaspersky Industrial CyberSecurity for Networks through the API when reinstalling Kaspersky Industrial CyberSecurity for Networks. To update certificates, in the main installation menu select Change Server settings → Change the settings for connecting to the Server via API and type y at the Generate new certificates prompt.

Certificates will be updated after reinstallation of Kaspersky Industrial CyberSecurity for Networks.

Page top