Community
User Guides
Support
Community
Help Forums
English Forum
General
About our Community
General Discussion
News and Feedback
Products
F-Secure SAFE
F-Secure FREEDOME
F-Secure KEY
F-Secure SENSE Router
F-Secure ID PROTECTION
Other products
Beta programs
Feature Requests
Finnish Forum (Tukifoorumi)
Tuotteet Kotiin
F-Secure SAFE
F-Secure FREEDOME
F-Secure KEY
F-Secure SENSE Router
F-Secure ID PROTECTION
Muut tietoturvatuotteet
Support Articles
Language
English
Suomi
Deutsch
Français
日本語
Svenska
Dansk
Italiano
Nederlands
Norsk
Polski
中文 (繁體)
Products & Services
F-Secure TOTAL
F-Secure SAFE / Internet Security / Anti-Virus
F-Secure FREEDOME
F-Secure KEY
F-Secure SENSE Router
F-Secure ID PROTECTION
Other products
Common topics
User Guides
Support
Login
|
Register
How to use F-Secure Endpoint Proxy with Software Updater - F-Secure Community
<main> <article class="userContent"> <p> </p>How to use F-Secure Endpoint Proxy with Software Updater <p>F-Secure Endpoint Proxy, also referred to as Policy Manager Proxy (PMP) is provided by F-Secure to minimize the bandwidth usage while downloading updates to the clients with F-Secure Elements Agent installed. </p> <p>This proxy caches software installation packages. If the PMP is not available, the clients may automatically fall back to accessing third-party vendor servers directly or the clients will not use them; the algorithm depends on the Software Updater settings. </p> <p>To use F-Secure Endpoint Proxy together with Software Updater, you need to have a trusted certificate. We highly recommended using a commercial certificate, as they are a more secure way to establish a connection and serve the software installation packages. However, for testing purposes, you can use a self-signed certificate. </p> <p><strong>Note:</strong> Certificates come in many different formats, and this guidance assumes that you have a basic understanding of the concepts such as certificate chains, java keystores, converting certificates from one format to another, and so on. It is also possible that the certificates you purchase are not in the correct format expected for these instructions, in which case you might need to convert them to the expected format. </p> <p>These instructions cover configuring F-Secure Endpoint Proxy using a commercial certificate as follows: </p> <ol><li> Obtain and prepare the certificate <ol type="a"><li> Obtain an SSL certificate from your certificate authority (CA) vendor. Make sure of the following: <ul><li>The certificate is signed by a party, trusted on all your computers. </li> <li>The certificate is in <a rel="nofollow" href="https://en.wikipedia.org/wiki/PKCS_12">PKCS 12</a> format. <br><strong>Note:</strong> This format usually has the following file extensions: <code class="code codeInline" spellcheck="false" tabindex="0">*.p12</code> or <code class="code codeInline" spellcheck="false" tabindex="0">*.pfx</code>. It is possible to convert the certificate to PKCS 12 format, usually the party providing the certificate should be able to provide you with instructions. </li> </ul></li> <li> Import the <a rel="nofollow" href="https://en.wikipedia.org/wiki/PKCS_7"> PKCS 7</a> certificate to the keystore with the following command: <pre class="code codeBlock" spellcheck="false" tabindex="0">%JDK_HOME%/bin/keytool -importcert -alias server -keystore %PATH_TO_KEYSTORE% -file <path-to-chain-p7.pem></pre> <div>Where: <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">JDK_HOME</code> is your java installation directory. </li> <li><code class="code codeInline" spellcheck="false" tabindex="0">PATH_TO_KEYSTORE</code> is a path to the existing or new keystore. </li> </ul></div> <div>For example, on Windows, this command may look like the following: <pre class="code codeBlock" spellcheck="false" tabindex="0">C:\Program Files (x86)\F-Secure\Management Server 5\jre\bin\keytool -importcert -alias server -keystore server.p12 -file mycertchain.pem</pre> </div> </li> </ol></li> <li> Replace the default PM Proxy Java applications expect all certificates to be stored in the Java keystore. New certificates can be imported using keytool which is located under the Java installation locations bin directory. <ol type="a"><li> Import the certificate to the keystore using the following command: <pre class="code codeBlock" spellcheck="false" tabindex="0">%JDK_HOME%/bin/keytool -importkeystore -destkeystore "%FSPMS_HOME%\data\fspms.jks" -deststorepass superPASSWORD -destalias fspms -destkeypass superPASSWORD -srckeystore <MyCert.p12> -srcstoretype PKCS12 -srcstorepass <yourcertpassword> -srcalias %ALIAS%</pre> <div>Where: <ul><li> <ul><li><code class="code codeInline" spellcheck="false" tabindex="0">%JDK_HOME%</code> is your Java installation directory. </li> <li><code class="code codeInline" spellcheck="false" tabindex="0">%FSPMS_HOME%</code> is your PMP proxy installation directory. </li> <li><code class="code codeInline" spellcheck="false" tabindex="0">%ALIAS%</code> is the preferred alias for the certificate in the keystore. </li> </ul></li> </ul></div> <div>For example, on Windows, this command may look like the following: <pre class="code codeBlock" spellcheck="false" tabindex="0">"C:\Program Files (x86)\F-Secure\Management Server 5\jre\bin\keytool" -importkeystore -destkeystore "C:\Program Files (x86)\F-Secure\Management Server 5\data\fspms.jks" -deststorepass superPASSWORD -destalias fspms -destkeypass superPASSWORD -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass <yourcertpassword> -srcalias server Existing entry alias server exists, overwrite? [no]: -> yes</pre> </div> </li> </ol></li> <li> Configure your PM Proxy to use HTTPS <ol type="a"><li> Navigate in the registry to: <code class="code codeInline" spellcheck="false" tabindex="0">"HKLM\SOFTWARE\Wow6432Node\DataFellows\F-Secure\Management Server"</code> </li> <li> Add <code class="code codeInline" spellcheck="false" tabindex="0">"-DpsbProxyMode=true"</code> to <code class="code codeInline" spellcheck="false" tabindex="0">"additional_java_args"</code>. </li> <li> Check that <code class="code codeInline" spellcheck="false" tabindex="0">"HttpsPortNum"</code> is 443. If it isn't, change it to 443. </li> <li> Exit registry editor and restart the PMP proxy. </li> </ol></li> </ol><p>F-Secure Endpoint Proxy is now configured to work with Software Updater. </p> <p>If you want to know more about how Software Updater works with F-Secure Endpoint Proxy, visit this <a rel="nofollow" href="https://help.f-secure.com/product.html#business/psb-portal/latest/en/task_822858DC46F844E89B16C2E4AD39C524-psb-portal-latest-en">help topic</a>. </p> </article> </main>