Certificate

The AP Registration Certificate Screen displays information and is used to create, edit, delete, and download a Web Server/External Portal Server Certificate File. This Certificate File is used to establish a secure connection between OmniVista and APs when using the Web UI Device Management Tool as well as a secure connection to an External Portal Server. The page is also used to upload the following certificates to OmniVista:

Once the certificates are created/uploaded, you must go to the AP Group Screen and edit an AP Group to apply the certificate(s) to the AP Group. The fields are located in the "Certificate" section of the AP Group configuration screen.

Creating a Certificate

Click on the Add icon, select Web Server/External Portal Server, and complete the fields as described below. When you are finished, click on the Create button.

Important Note: APs only support certificates based on FQDN, not IP Address. When generating the CSR file, you must match the "CN" field to the URL "mywifi.al-enterprise.com".

To generate a Web Server/External Portal Server Certificate file, follow the example below:

1. Generate a private Key: openssl genrsa -des3 -out ap_server.key 2048.

2. Generate a CSR (Certificate Signing Request): openssl req -new -key ap_server.key -out ap_server.csr -sha256. Note that you must enter the URL "mywifi.al-enterprise.com" for the Common Name (CN).

3. Sign and generate the AP certificate using a root CA:  openssl x509 -req -in ap_server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out ap_server.crt -days 3560 -sha256.

4. Merge ap_server.crt and ap_server.key to a single file: type ap_server.crt ap_server.key > ap_server.pem.

Editing a Certificate

You can edit the description of a Web Server/External Portal Server Certificate. Select the certificate in the Certificate List and click on the Edit icon. When you are finished, click on the Apply button.

Deleting a Certificate

Select the certificate in the Certificate List and click on the Delete icon. Click OK at the Confirmation Prompt.

Downloading a Certificate

Select a file in the Certificate List and click on the Download icon at the top of the screen to download the file to your PC.

Uploading an LDAP Certificate

Click on the Add icon and select Local LDAP to bring up the Create Local LDAP Certificate Screen. Complete the fields as described below, then click on the Create button.

Uploading an 802.1X Client Certificate

A built-in 802.1X client certificate is provided by default. If you want to upload a custom 802.1X client certificate, click on the Add icon and select 802.1X Client to bring up the Create 802.1X Client Certificate Screen. Complete the fields as described below, then click on the Create button.

Uploading a Local RadSec Certificate

Consider the following information when uploading a Local RadSec Certificate in OmniVista:

And, Password for Client Key.

Notes:

  1. Do not import multiple CAs without an issuance order. If you import multiple CAs without an issuance order, OmniVista only parses and applies the first one to the AP.

    1. Make Client Certificate and Client Key in two files separately. Client Certificate file should not include Client Key because when OmniVista converts certificate to CRT format, only the certificate part is converted, and the private key part is ignored.
    2. CA Certificate file will be converted to CRT format and applied to AP, but content of the Certificate part is not changed.

    To upload a Local RadSec Certificate, click on the Add icon and select Local Radsec to bring up the Create Local Radsec Certificate Screen. Complete the fields as described below, then click on the Create button.

    Uploading a Stellar BLE Certificate

    The Stellar BLE data reporting channel to any Asset Tracking application uses Kafka. However, the built-in common device certificate on the AP allows communication only with Stellar AP Asset Tracking solutions. You can upload a custom device certificate to the AP that will support sending BLE data to third-party Asset Tracking applications.

    Note: Refer to Stellar BLE Data Format for information about the data format used to send BLE messages to third-party Asset Tracking applications.

    To upload a BLE Certificate, click on the Add icon and select Stellar BLE to bring up the Create Stellar BLE Certificate Screen. Complete the fields as described below, then click on the Create button.

    Syslog Over TLS Certificate

    The Syslog Over TLS Certificate is used when configuring remote logging of AP events over TLS for an AP Group.

    Click on the Add icon and select Syslog Over TLS to bring up the Create Syslog Over TLS Certificate Screen. Complete the fields as described below, then click on the Create button.

    Create Stellar WIFI RTLS Certificate

    The Stellar WiFi RTLS data reporting channel uses Kafka. However, the built-in common device certificate on the AP allows communication only with the OmniVista Cirrus 10 Stellar WiFi engine. You can upload a custom device certificate to the AP that will support sending WiFi RTLS data to third-party RTLS applications.

    Note: Refer to Stellar WiFi RTLS Data Format for information about the data format used to send RTLS messages to third-party RTLS applications.

    To upload a Stellar WiFi RTLS Certificate, click on the Add icon and select Stellar WIFI RTLS to bring up the Create Stellar WIFI RTLA Certificate Screen. Complete the fields as described below, then click on the Create button.

    Certificate List

    Web Server/External Portal Server File

    Local LDAP File

    802.1X Client File

    Local RadSec

    Stellar BLE

    Syslog Over TLS

    Stellar WiFi RTLS

    Stellar BLE Data Format

    Consider the following information and data format that is used to send BLE messages to third-party Asset Tracking applications:

    Notes:

    1. To get smoothing BLE data, if the RssiFormat is “average” and the number of scans in a reporting cycle is greater than three, the highest and lowest values are removed and the average value is taken.
    2. To include the channel of the BLE channel of collected RSSI:
      1. BLE has only three fixed broadcast channels, and in a broadcast event, a broadcast packet is transmitted on each channel. As a result, it is not possible for the scanning device to specify that the scanning should take place on a specific channel.
      2. In a scanning event, the device will scan three channels in turn, and the scanned response data does not contain the channel.
      3. If it is the scanning channel of the WiFi, that is supported.

    The reporting JSON data format is similar to the following:

    Stellar WiFi RTLS Data Format

    Consider the following information and data format that is used to send WiFi RTLS data to third-party RTLS applications:

    The reporting JSON data format is similar to the following: