The AP Registration Certificate Screen displays information and is used to create, edit, delete, and download a Web Server/External Portal Server Certificate File. This Certificate File is used to establish a secure connection between OmniVista and APs when using the Web UI Device Management Tool as well as a secure connection to an External Portal Server. The page is also used to upload the following certificates to OmniVista:
Once the certificates are created/uploaded, you must go to the AP Group Screen and edit an AP Group to apply the certificate(s) to the AP Group. The fields are located in the "Certificate" section of the AP Group configuration screen.
Click on the Add icon, select Web Server/External Portal Server, and complete the fields as described below. When you are finished, click on the Create button.
Important Note: APs only support certificates based on FQDN, not IP Address. When generating the CSR file, you must match the "CN" field to the URL "mywifi.al-enterprise.com".
To generate a Web Server/External Portal Server Certificate file, follow the example below:
1. Generate a private Key: openssl genrsa -des3 -out ap_server.key 2048.
2. Generate a CSR (Certificate Signing Request): openssl req -new -key ap_server.key -out ap_server.csr -sha256. Note that you must enter the URL "mywifi.al-enterprise.com" for the Common Name (CN).
3. Sign and generate the AP certificate using a root CA: openssl x509 -req -in ap_server.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out ap_server.crt -days 3560 -sha256.
4. Merge ap_server.crt and ap_server.key to a single file: type ap_server.crt ap_server.key > ap_server.pem.
You can edit the description of a Web Server/External Portal Server Certificate. Select the certificate in the Certificate List and click on the Edit icon. When you are finished, click on the Apply button.
Select the certificate in the Certificate List and click on the Delete icon. Click OK at the Confirmation Prompt.
Select a file in the Certificate List and click on the Download icon at the top of the screen to download the file to your PC.
Click on the Add icon and select Local LDAP to bring up the Create Local LDAP Certificate Screen. Complete the fields as described below, then click on the Create button.
A built-in 802.1X client certificate is provided by default. If you want to upload a custom 802.1X client certificate, click on the Add icon and select 802.1X Client to bring up the Create 802.1X Client Certificate Screen. Complete the fields as described below, then click on the Create button.
Consider the following information when uploading a Local RadSec Certificate in OmniVista:
And, Password for Client Key.
Notes:
- Do not import multiple CAs without an issuance order. If you import multiple CAs without an issuance order, OmniVista only parses and applies the first one to the AP.
- Make Client Certificate and Client Key in two files separately. Client Certificate file should not include Client Key because when OmniVista converts certificate to CRT format, only the certificate part is converted, and the private key part is ignored.
- CA Certificate file will be converted to CRT format and applied to AP, but content of the Certificate part is not changed.
To upload a Local RadSec Certificate, click on the Add icon and select Local Radsec to bring up the Create Local Radsec Certificate Screen. Complete the fields as described below, then click on the Create button.
- Upload Server CA File - Click on the Upload button and locate the RadSec CA Certificate. Click on the Import button.
- Upload Client Certificate File - Click on the Upload button and locate the AP Certificate File. Click on the Import button.
- Upload Client Key File - Click on the Upload button and locate the AP Certificate Private Key File. Click on the Import button.
- Name - Enter a Name for the Certificate.
- Private Key Password - Enter a Private Key Password to encrypt the key file when generating the CA File.
Uploading a Stellar BLE Certificate
The Stellar BLE data reporting channel to any Asset Tracking application uses Kafka. However, the built-in common device certificate on the AP allows communication only with Stellar AP Asset Tracking solutions. You can upload a custom device certificate to the AP that will support sending BLE data to third-party Asset Tracking applications.
Note: Refer to Stellar BLE Data Format for information about the data format used to send BLE messages to third-party Asset Tracking applications.
To upload a BLE Certificate, click on the Add icon and select Stellar BLE to bring up the Create Stellar BLE Certificate Screen. Complete the fields as described below, then click on the Create button.
- Upload Server CA File - Click on the Upload button and locate the Stellar BLE CA Certificate. Click on the Import button.
- Upload Server File - Click on the Upload button and locate the AP Certificate File. Click on the Import button.
- Upload Client Key File - Click on the Upload button and locate the AP Certificate Private Key File. Click on the Import button.
- Name - Enter a Name for the Certificate.
- Private Key Password - Enter a Private Key Password to encrypt the key file when generating the CA File.
Syslog Over TLS Certificate
The Syslog Over TLS Certificate is used when configuring remote logging of AP events over TLS for an AP Group.
Click on the Add icon and select Syslog Over TLS to bring up the Create Syslog Over TLS Certificate Screen. Complete the fields as described below, then click on the Create button.
- Upload CA File - Click on the Upload button and locate the Syslog Over TLS CA Certificate. Click on the Import button.
- Name - Enter a Name for the Certificate.
Create Stellar WIFI RTLS Certificate
The Stellar WiFi RTLS data reporting channel uses Kafka. However, the built-in common device certificate on the AP allows communication only with the OmniVista Cirrus 10 Stellar WiFi engine. You can upload a custom device certificate to the AP that will support sending WiFi RTLS data to third-party RTLS applications.
Note: Refer to Stellar WiFi RTLS Data Format for information about the data format used to send RTLS messages to third-party RTLS applications.
To upload a Stellar WiFi RTLS Certificate, click on the Add icon and select Stellar WIFI RTLS to bring up the Create Stellar WIFI RTLA Certificate Screen. Complete the fields as described below, then click on the Create button.
- Upload Client CA File - Click on the Upload button and locate the Stellar WIFI RTLS CA Certificate. Click on the Import button.
- Upload Client File - Click on the Upload button and locate the AP Certificate File. Click on the Import button.
- Upload Client Key File - Click on the Upload button and locate the AP Certificate Private Key File. Click on the Import button.
- Name - Enter a Name for the Certificate.
- Private Key Password - Enter a Private Key Password to encrypt the key file when generating the CA File.
Certificate List
Web Server/External Portal Server File
- Name - The name of the certificate file.
- Type - The type of certificate (Web Server/External Portal Server).
- Validity Start Time - Validity starting time of the certificate file.
- Validity Stop Time - Validity ending time of the certificate file.
- Format - The format of the certificate file (e.g., .pem).
- Description - User-configured description for the certificate file.
- Issuer - The entity that issued the certificate.
- Serial Number - Serial number of the certificate.
Local LDAP File
- Name - The name of the certificate file.
- Type - The type of certificate ( Local LDAP).
- Validity Start Time - Validity starting time of the certificate file.
- Validity Stop Time - Validity ending time of the certificate file.
- CA File Name - The name of the CA file.
- Server File Name - The name of the certificate file.
- Key File Name - The name of the key file.
- Issued By- The entity that issued the certificate.
- Issued To - The entity to which the certificate was issued.
802.1X Client File
- Name - The name of the certificate file.
- Type - The type of certificate (802.1X Client).
- Validity Start Time - Validity starting time of the certificate file.
- Validity Stop Time - Validity ending time of the certificate file.
- AP Certificate File Name - The name of the CA file.
- Key File Name - The name of the key file.
Local RadSec
- Name - The name of the certificate file.
- Type - The type of certificate (Local RadSec).
- Validity Start Time - Validity starting time of the certificate file.
- Validity Stop Time - Validity ending time of the certificate file.
- CA File Name - The name of the CA file.
- Client Certificate File Name - The name of the client certificate file.
- Client Certificate Key File Name - The name of the client key file.
- Issued By- The entity that issued the certificate.
- Issued To - The entity to which the certificate was issued.
Stellar BLE
- Name - The name of the certificate file.
- Type - The type of certificate (Stellar BLE).
- Validity Start Time - Validity starting time of the certificate file.
- Validity Stop Time - Validity ending time of the certificate file.
- Client CA File Name - The name of the CA file.
- Client Certificate File Name - The name of the client certificate file.
- Client Certificate Key File Name - The name of the client key file.
- Issued By- The entity that issued the certificate.
- Issued To - The entity to which the certificate was issued.
Syslog Over TLS
- Name - The name of the certificate file.
- Type - The type of certificate (Syslog Over TLS).
- Validity Start Time - Validity starting time of the certificate file.
- Validity Stop Time - Validity ending time of the certificate file.
- CA File Name - The name of the CA file.
- Issued By- The entity that issued the certificate.
- Issued To - The entity to which the certificate was issued.
Stellar WiFi RTLS
- Name - The name of the certificate file.
- Type - The type of certificate (Stellar RTLS).
- Validity Start Time - Validity starting time of the certificate file.
- Validity Stop Time - Validity ending time of the certificate file.
- Client CA File Name - The name of the CA file.
- Client Certificate File Name - The name of the client certificate file.
- Client Certificate Key File Name - The name of the client key file.
- Issued By- The entity that issued the certificate.
- Issued To - The entity to which the certificate was issued.
Stellar BLE Data Format
Consider the following information and data format that is used to send BLE messages to third-party Asset Tracking applications:
- The payload data format of the Bluetooth gateway report is an array of JSON, which contains one or more Bluetooth device information scanned in a reporting cycle.
- The reported information includes information about the scanned Bluetooth device and the Bluetooth gateway. Consider the following data format used to report the scanned information.
Notes:
- To get smoothing BLE data, if the RssiFormat is “average” and the number of scans in a reporting cycle is greater than three, the highest and lowest values are removed and the average value is taken.
- To include the channel of the BLE channel of collected RSSI:
- BLE has only three fixed broadcast channels, and in a broadcast event, a broadcast packet is transmitted on each channel. As a result, it is not possible for the scanning device to specify that the scanning should take place on a specific channel.
- In a scanning event, the device will scan three channels in turn, and the scanned response data does not contain the channel.
- If it is the scanning channel of the WiFi, that is supported.
The reporting JSON data format is similar to the following:
Stellar WiFi RTLS Data Format
Consider the following information and data format that is used to send WiFi RTLS data to third-party RTLS applications:
- The payload data format of the gateway report is an array of JSON, which contains one or more WiFi device information scanned in a reporting cycle.
- The reported information includes information about the scanned WiFi device and the gateway. Consider the following data format used to report the scanned information.
The reporting JSON data format is similar to the following: