Import the CA certificate

Information about importing the CA certificate.

UC uses self-signed certificates by default. When you sign in to MC and switch to UC, the browser displays a security prompt. To avoid this prompt each time when switching to UC, import the CA certificates.

About CA certificate

Import a CA certificate to establish a trusted HTTPS connection between your web browser and UC. After you import the certificate, the browser can verify the identity of UC and securely connect without displaying certificate trust warnings.

What are CA certificates?

A Certificate Authority (CA) certificate is a digital certificate that establishes trust between a client and a server. UC uses HTTPS certificates that are signed by an internal CA certificate. Browsers do not automatically trust this internal CA because it is not issued by a public certificate authority.

By importing the UC CA certificate into your browser's trusted certificate store, you allow the browser to trust the certificates used by UC.

This CA certificate enables secure HTTPS communication between the browser and UC.

Why import the CA certificate?

Importing the CA certificate helps you:

  • Establish a trusted HTTPS connection to UC.
  • Eliminate browser certificate warnings when accessing UC.
  • Verify the identity of the UC server.
  • Protect communication between your browser and UC through encryption.

Before you begin

Verify that you have the following:

  • Access to the UC host.
  • Access to the UC certificate directory /opt/vconsole/uc/certs.
  • The CA certificate file /opt/vconsole/uc/certs/ca.crt.
  • Administrative permissions on the client machine where you plan to import the CA certificate.

How certificate trust works

UC generates an internal CA certificate and uses it to sign service certificates. Before your browser can trust UC, you must import the following certificate into the browser's trusted certificate store:

/opt/vconsole/uc/certs/ca.crt

You only need to import the CA certificate once on each client machine.

Configure Google Chrome

Import the UC CA certificate into the Windows Trusted Root Certification Authorities store that Google Chrome uses.

Step 1: Open the Certificate Manager

  • Open Google Chrome.
  • In the address bar, enter: chrome://certificate-manager/
  • Select Local certificates.
  • Click Manage imported certificates from Windows.

Step 2: Import the CA Certificate

  • Select the Trusted Root Certification Authorities tab.
  • Click Import.
  • Click Browse.
  • Select /opt/vconsole/uc/certs/ca.crt.
  • Click Next.
  • Select Place all certificates in the following store.
  • Click Browse.
  • Select Trusted Root Certification Authorities.
  • Click OK.
  • Click Next.
  • Click Finish.

Verify:

  • The import operation completes without errors.
  • The certificate appears in the Trusted Root Certification Authorities store.
  • You can open UC without browser trust warnings.

Success

  • The UC login page loads normally.
  • The browser displays a secure HTTPS connection.
  • No certificate warning appears.

Failure

  • The browser displays a certificate warning.
  • The browser reports that the connection is not trusted.
  • UC displays HTTPS security errors.

Configure Microsoft Edge

Step 1: Open the Certificate Manager

  • Open Microsoft Edge.
  • In the address bar, enter: edge://certificate-manager/
  • Select Local certificates.
  • Click Manage imported certificates from Windows.

Step 2: Import the CA certificate

  • Click the Trusted Root Certification Authorities tab.
  • Click Import.
  • Click Browse.
  • Select /opt/vconsole/uc/certs/ca.crt.
  • Click Next.
  • Select Place all certificates in the following store.
  • Click Browse.
  • Select Trusted Root Certification Authorities.
  • Click OK.
  • Click Next.
  • Click Finish.

Verify:

  • The import operation completes successfully.
  • The certificate is listed in the Trusted Root Certification Authorities store.
  • UC opens without browser trust warnings.

Success

  • The UC login page loads successfully.
  • The browser reports a secure connection.
  • No trust or certificate warnings appear.

Failure

  • The browser displays certificate trust warnings.
  • HTTPS connection errors occur.
  • UC does not open through HTTPS without user intervention.

Configure Mozilla Firefox

Mozilla Firefox maintains its own certificate store. You must import the CA certificate directly into Firefox.

Step 1: Open Certificate Settings

  • Open Mozilla Firefox.
  • In the address bar, type about:preferences#privacy.
  • Click Settings and select Privacy and security.
  • From the Connection and software security drop-down list, select Advanced settings.
  • Scroll to Certificates.
  • Click Manage Certificates.

Step 2: Import the CA certificate

  • Select the Authorities tab.
  • Click Import.
  • Browse to /opt/vconsole/uc/certs/ca.crt.
  • Click Open.
  • Select Trust this CA to identify websites.
  • Click OK.
  • Click OK again to close the Certificate Manager.

Verify:

  • The certificate appears in the Authorities list.
  • Firefox connects to UC without certificate warnings.
  • The UC login page opens successfully.

Success

  • Firefox establishes a secure HTTPS connection to UC.
  • No certificate trust warnings appear.
  • The UC login page loads successfully.

Failure

  • Firefox displays security warnings.
  • Firefox reports that the issuer is not trusted.
  • The UC login page does not load securely.

Replace the default CA certificate with a custom certificate

You can replace the default UC-generated CA certificate with a certificate issued by your organization's internal security team.

Organizations commonly use custom certificates to:

  • Comply with corporate security policies.
  • Use certificates issued by an approved internal CA.
  • Standardize certificate management across systems.
  • Eliminate the need to trust product-generated certificates separately.

File naming requirements

Use the same file names that UC expects. Replacing the default files while preserving the file names ensures that services continue to locate and use the certificates correctly.

Step 1: Back up existing certificates

Create a backup of the existing certificate files before making changes.

Step 2: Copy the custom certificates

Copy the replacement certificate files to /opt/vconsole/uc/certs.

Step 3: Restart UC services

Restart the services so that UC begins using the new certificates.

Run:

./scripts/service.sh start

Verify:

  • Services start successfully.
  • UC is accessible through HTTPS.
  • The browser trusts the new certificate chain.

Success

  • The UC login page loads successfully.
  • The certificate details display the new issuer.
  • HTTPS connections succeed.

Failure

  • Services fail to start.
  • The browser displays certificate errors.
  • HTTPS connections fail.

Verify certificate configuration

After importing the certificate or replacing it with a custom certificate:

Success

  • UC opens successfully.
  • No trust warning appears.
  • The browser indicates a secure connection.

Failure

  • The browser displays certificate warnings.
  • The browser reports an untrusted issuer.
  • The browser cannot establish a secure connection.

CA certificate example

The UC certificate directory contains the following files:

/opt/vconsole/uc/certs
ca.crt
ca.key
bff.crt
bff.key
metadata.crt
metadata.key
sqlexec.crt
sqlexec.key
auth.crt
auth.key
ai.crt
ai.key
aiassist.crt
aiassist.key

Certificate architecture

  • ca.crt is the root CA certificate used by UC.
  • ca.key is the private key associated with the CA certificate.
  • Service certificates such as bff.crt, auth.crt, and ai.crt are signed by ca.crt.
  • All UC services rely on the same internal CA certificate.

Additional information

You can generate certificates by using generate-certs.sh. If UC runs on a cloud-hosted virtual machine, allow inbound traffic on the following ports:

  • 5450
  • 8433

These ports must be reachable for browser access and service communication.