[CS Gold] Updating HID Certificates

Updating HID Certificates

1. Place the new certs in D:\CBORD\DCS\CSGoldWeb\certs\ on both the TPS server and Web server.

2. Update the SITEINFORMATIONS table parameters to point to the new certs. Each parameter should be certs/NewCertFileName.cer.

• HID_CLOUDPRINT_AUTHCERTFILE
• HID_CLOUDPRINT_CACERTFILE
• HID_CLOUDPRINT_DATACERTFILE

3. Encrypt the password sent by HID.

• From a Gold Server command prompt on the TPS, go to D:\CBORD\DCS\GoldServer\WebService\services.
• Type something like the following but replace “encrypt me” with what you want encrypted. The quotation marks are required
• php.exe encrypt.php "encrypt me"
• Priv editor in the web can also be used to encrypt the password.

4. Update the SITEINFORMATION table parameter HID_CLOUDPRINT_AUTHCERTPWD with the encrypted password from step 3.

• This can be done using the table editor module in the web or with any database connection tool.
• SQL*Plus is installed by default on the TPS server and can be used with a Gold admin command prompt.

5. Restart the Apache2.4 service on both servers.

Troubleshooting and known issues.

General Troubleshooting

• When a print job fails on the Gold side. Errors can be recorded in the system syslog table.
• Debug will need to be turned up to level 7 to capture meaningful output.

Increasing the debug level

• Use the following commands from SQL*Plus to increase the debug level for HID printing. Debug levels will automatically reset after 3 days using the commands below. These rely on the helper scripts being installed and in the SQLPATH environment variable location.
• Log into SQL*Plus.
• @setdebugwebcardprint 7
• @setdebug HID_Cloud_Print 7

Once the debug level is increased, recreate the issue and then query the syslog. An example query is listed below.

SELECT *

FROM syslog

WHERE moduleid IN (

'LOCAL_CARDPRINT_PREP',

'TRUCRED_SMARTCARD_P',

'CARDPRINT_SMARTCARD_P',

'TruCredentialBatchPrint',

'BatchPrint_Com',

'GET_CARDPRINT_FIELDS',

'GetPoolValue',

'GETLCCVALUE',

'WEB_BATCHCARDPRINT_PREP',

'batch_printcard',

'WEB_batch_printcard',

'HID_Cloud_Print')

AND postdate > SYSDATE - .1

ORDER BY postdate, ordernum;

Reviewing the out should point to the reason why Gold was unable to send a print job to HID.

Known issues

“Unable to set private key” error when printing has 2 known causes.

1. The API Client Auth Cert does not include the private key. This can be checked by opening the certificate in notepad. There should be 3 blocks of text. 2 certificates and 1 private key.
2. The API Client Auth Cert includes the private key, but in a format Gold cannot use. This is more common with older versions of Gold. Compare the new cert to the old certificate. Older keys were often issued as PKCS1. Newer keys are issued as PKCS8.
   • A PKCS1 key will begin with -----BEGIN RSA PRIVATE KEY-----
   • A PKCS8 key will begin with -----BEGIN ENCRYPTED PRIVATE KEY-----

Fixes.

1. If the key was not included, reach out to printers@hidglobal.com to get new certificates generated.
2. You may be able to decrypt the key and re-encrypt it to use a known good encryption method for your system. Check how the old certificates key was encrypted (if at all) and re-encrypt it using that format and the same password.

“Unable to get local certificate” error has at least 1 known cause.

1. The issuer certificate for the API client auth cert was not included. This can be checked by viewing the cert in notepad. There should be 2 certificates and 1 private key.

Fix.

1. Reach out to printers@hidglobal.com to get the issuer cert or new certificates generated.

Additional notes:

1. The password provided in the email from HID is the password used to encrypt the private key.