Skip to content

Generate External Certificates

Before you start

Goal

Generate TLS certificates for Altair SLC Hub to enable secure HTTPS communication.

Prerequisites

Important: Step ordering

This page is part of a sequence of configuration steps. They must be completed in this order:

  1. Generate external certificates (this page) – Create TLS certificates
  2. Configure ingress and enable HTTPS – Set hostname, port, and TLS settings
  3. Bootstrap – Apply configuration and initialize Keycloak

If you skip this step or do these steps out of order, bootstrap will fail.

Why certificates are required

Altair SLC Hub uses Keycloak for authentication and user management. Keycloak requires HTTPS (secure, encrypted connections) to function correctly. HTTPS requires TLS certificates to:

  • Encrypt communication between browsers and Altair SLC Hub
  • Authenticate the server to users' browsers

Without valid TLS certificates, Keycloak will initialize but users will not be able to log in.

Generate external certificates - for temporary use only

Warning

Do not use a self-signed certificate in a production environment. Plan to obtain a certificate signed by a trusted certificate authority before go-live.

Run the following command:

hubctl generate externalcert

You should see output similar to:

INF Creating new external CA certificate
INF Creating new certificate certificate="External Server"
INF Successful
Success - generated external CA and server certificates

This command automatically creates certificate files:

Platform Certificate Location
Linux [var directory]/ca/public/external/
Windows [var directory]\ca\public\external\
  • external.cert.pem – The external server certificate
  • external.ca.cert.pem – The external CA certificate
  • external.key.pem – The external server private key
  • external.ca.key.pem – The external CA private key

Warning

Browsers will not trust this certificate by default and users will see a security warning. This is only appropriate while waiting for a certificate from your IT department and must not be used in production. See Generating external certificates for testing for more details.

Verify certificate generation

After the certificates are generated, check that you have the correct file permissions:

cd /opt/altair/slchub/var/ca/public/external/
ls -l /opt/altair/slchub/var/ca/public/external/

The certificates should have 0644 permissions (owner: read/write, group and others: read-only): 

-rw-r--r-- slchub slchub external.cert.pem
-rw-r--r-- slchub slchub external.key.pem

If the permissions are incorrect, fix them with: 

chmod 0644 /opt/altair/slchub/var/ca/public/external/external.cert.pem
chmod 0644 /opt/altair/slchub/var/ca/public/external/external.key.pem

Verify the certificates were created by navigating to: 

 C:\ProgramData\altair\SLC Hub\ca\public\external\

You should see:

  • external.cert.pem – The external server certificate
  • external.key.pem – The external server private key

Store certificates in the system trust store

To enable secure browser access, you must store the certificates in your system's certificate trust store.

Why store certificates

Storing certificates in the system trust store allows your browser to recognize and trust the certificates used by Altair SLC Hub. Without this step, your browser will show security warnings when accessing Altair SLC Hub.

Store certificates

Add both the internal TLS certificate and the external certificate to the certificate store:

cd "C:\ProgramData\altair\SLC Hub\ca\public\"
certutil -addstore ROOT CA.cert.pem

cd "C:\ProgramData\altair\SLC Hub\ca\public\external\"
certutil -addstore ROOT external.ca.cert.pem

Expected output:

ROOT "Trusted Root Certification Authorities"
Signature matches Public Key
Certificate "RootCA" added to store.
CertUtil: -addstore command completed successfully.

Copy the certificates to the system's CA trust directory:

sudo cp /opt/altair/slchub/var/ca/public/CA.cert.pem /etc/pki/ca-trust/source/anchors/
sudo cp /opt/altair/slchub/var/ca/public/external/external.ca.cert.pem /etc/pki/ca-trust/source/anchors/

Then update the CA trust store:

sudo update-ca-trust

Certificates generated and stored successfully

Your browser will now trust Altair SLC Hub without displaying security warnings. The external certificates have been created and are ready to use. You can now proceed to Configure ingress and enable HTTPS.