To install an existing certificate, complete the following steps and import the certificate into ASE. If you have intermediate certificate from a CA, then append the content to your server .crt file.

  1. Create the key from the existing .pem file: 
    openssl rsa -in private.pem -out private.key
  2. Convert the existing .pem file to a .crt file: 
    openssl x509 -in server-cert.pem -out server-cert.crt
  3. Import the key pair from step 2: 
    /opt/pingidentity/ase/bin/cli.sh import_key_pair private.key -u admin -p
Warning: import_key_pair will overwrite any existing certificates
Do you want to proceed [y/n]:y
Exporting key to API Security Enforcer...
OK, key pair added to keystore
  4. Import the .crt file in ASE using the import_cert CLI command: 
    /opt/pingidentity/ase/bin/cli.sh import_cert server-crt.crt -u admin -p
Warning: import_cert will overwrite any existing signed certificate
Do you want to proceed [y/n]:y
Exporting certificate to API Security Enforcer...
OK, signed certificate added to keystore
  5. Restart ASE by stopping and starting.