Set Up SSL Keys for SAML 2.0
To use Hub as the Identity Provider with SAML, you must encrypt the connection between Hub and a Service Provider. You need to generate an SSL key and a certificate, pack them in a PKCS12 format file, and upload it to Hub.
There are several tools that let you create SSL keys and certificates in PKCS12 format. We describe how to create SSL keystore with the OpenSSL toolkit.
To create an SSL keystore with OpenSSL:
Generate a new 2048 bit RSA key with password protection:
openssl genrsa -des3 -out Hub_SAML.key 2048Generate a certificate request for the generated key:
openssl req -new -key Hub_SAML.key -out Hub_SAML.csrGenerate a certificate:
openssl x509 -req -days 365 -in Hub_SAML.csr -signkey Hub_SAML.key -out Hub_SAML.crtPackage the key and the certificate in a PKCS12 file:
openssl pkcs12 -export -out Hub_SAML.p12 -inkey Hub_SAML.key -in Hub_SAML.crt -certfile Hub_SAML.crtYou have a PKCS12 keystore (
Hub_SAML.p12in the example) that is ready for upload to Hub.
To import the PKCS12 keystore to Hub:
In the Server Settings section of the Administration menu, select .
Click the Import keystore button.
Select the created
.p12key file, provide the password, and upload the keystore to Hub.In the Access Management section of the Administration menu, select .
Select the key in the SSL Key drop-down list on the Settings tab.
Hub encrypts the connection with SAML Service Providers using the selected SSL key. Hub also extracts and displays the SHA-256, SHA-1, and MD-5 Fingerprints of the certificate that is packed into the selected keystore.
A service provider may require any of these fingerprints to enable and configure SAML2.0 on its side.