HaloPSA

HaloPSA Guides

Documentation to assist with the setup and configuration of the HaloPSA platform

Guides > X.509 for encryption

X.509 for encryption

Generate a self-signed certificate

First, you need to generate a self-signed certificate to use for encryption.

If you have not done this before, you can download a free tool to do this for you here;

https://s3.amazonaws.com/pluralsight-free/keith-brown/samples/SelfCert.zip

Run SelfCert.exe.

Under "save as PFX", enter a strong password for your certificate and press Save to PFX file.

This will generate a PFX.

Store the password you entered securely. If you lose this, your encrypted data can be permanently lost.

Install the certificate on the Halo server

The certificate should be installed in both the Personal and Trusted Root stores of the local machine.

Open the certificate you generated on your Halo web application server.

Choose Store Location as Local Machine and enter the password for the certificate when prompted. No other settings need to be changed, navigate through the wizard and press Finish to install.

Install the certificate again using the same steps as above, but this time select "Place all certificates in the following store", and choose "Trused Root Certification Authorities".

Once installed, obtain the thumbprint of your certificate by opening Certificate Manager on the server. Find the certificate you added. Open it and view the thumbprint. It should look similar to the one below. Copy it as you'll need it for the next step.

15ae61e07414a8b0f9f48c470b1dbd7ab8e0c5b0

Configure the Halo website

On your Halo web application server, open the website files and open /api/appsettings.json.

Add a comma to the end of the second from the bottom line, insert a new line and add;

  "EncryptionThumbprint": "THUMBPRINT"

where THUMBPRINT is the thumbprint of your certificate.

Save and restart the Halo website.

To verify this is working, check that X.509 for encryption is now ticked on the Security page.

If Halo is unable to find the certificate still, try adding the IIS_IUSRS user group to the certificate permissions. Find the certificate in certificate manager > Personal. Right-click the certificate > Manage Private Keys > add the user group with full control and confirm.

Popular Guides