Replacing the Administration Server certificate by using the klsetsrvcert utility

To replace the Administration Server certificate:

From the command line, run the following utility:

klsetsrvcert [-t <type> {-i <inputfile> [-p <password>] [-o <chkopt>] | -g <dnsname>}][-f <time>][-r <calistfile>][-l <logfile>]

You do not need to download the klsetsrvcert utility. It is included in the Kaspersky Security Center distribution kit. It is not compatible with previous Kaspersky Security Center versions.

The description of the klsetsrvcert utility parameters is presented in the table below.

Values of the klsetsrvcert utility parameters

Parameter	Value
`-t <type>`	Type of certificate to be replaced. Possible values of the `<type>` parameter: `C`—Replace the common certificate for ports 13000 and 13291. `CR`—Replace the common reserve certificate for ports 13000 and 13291. `M`—Replace the certificate for mobile devices on port 13292. `MR`—Replace the mobile reserve certificate for port 13292. `MCA`—Mobile client CA for auto-generated user certificates.
`-f <time>`	Schedule for changing the certificate, using the format "DD-MM-YYYY hh:mm" (for ports 13000 and 13291). Use this parameter if you want to replace the common or common reserve certificate before it expires. Specify the time when managed devices must synchronize with Administration Server on a new certificate.
`-i <inputfile>`	Container with the certificate and a private key in the PKCS#12 format (file with the .p12 or .pfx extension).
`-p <password>`	Password used for protection of the p12 container. The certificate and a private key are stored in the container, therefore, the password is required to decrypt the file with the container.
`-o <chkopt>`	Certificate validation parameters (semicolon separated). To use a custom certificate without signing permission, specify `-o NoCA` in the klsetsrvcert utility. This is useful for certificates issued by a public CA.
`-g <dnsname>`	A new certificate will be created for the specified DNS name.
`-r <calistfile>`	Trusted root Certificate Authority list, format PEM.
`-l <logfile>`	Results output file. By default, the output is redirected into the standard output stream.

For example, to specify the custom Administration Server certificate, use the following command:

klsetsrvcert -t C -i <inputfile> -p <password> -o NoCA

After the certificate is replaced, all Network Agents connected to Administration Server through SSL lose their connection. To restore it, use the command-line klmover utility.

To avoid losing the Network Agents connections, use the following command:

klsetsrvcert.exe -f "DD-MM-YYYY hh:mm" -t CR -i <inputfile> -p <password> -o NoCA

where "DD-MM-YYYY hh:mm" is the date 3–4 weeks ahead of the current one. The time shift for changing the certificate to a backup one will allow a new certificate to be distributed to all Network Agents.