The .PFX file exported in previous steps contains the server certificate signed by the Certification Authority as well as the corresponding private key. These two components must be extracted and saved into separate files in Base64-encoded (PEM) format to make them usable by the NComputing vSpace Console Server service. The extraction process can be performed on Windows with the commands from PowerShell PSPKI module or on any system platform with the openssl command.
Extracting the certificate and private key files with PowerShell on Windows
In Windows search bar or in Command Prompt, enter PowerShell to start Windows PowerShell.
If not yet installed, run the following command from PowerShell command prompt to install the PSPKI PowerShell module:
![](https://static.zohocdn.com/zoho-desk-editor/static/images/info.png)
Install-Module PSPKI
Press [Y] when asked whether you want to install modules from an untrusted repository. Also, if asked, accept the installation of necessary dependencies.
After installation, to make the module cmdlets available for users, import the PSPKI module:
![](https://static.zohocdn.com/zoho-desk-editor/static/images/info.png)
Import-Module PSPKI
Use following command to extract the certificate and private key into Base64-encoded file:
![](https://static.zohocdn.com/zoho-desk-editor/static/images/info.png)
Convert-PfxToPem -InputFile "\path\to\exported\certificate.pfx" -OutputFile "\path\to\extracted\cert.pem"
When asked, provide the password which has been set when exporting the .PFX file. The extracted file will contain the certificate and private key.
Note: As the extracted private key will be unencrypted, it’s advisable to extract the files into a directory which is not accessible by unpermitted users.
Copy the extracted “cert.pem” file to “priv.key” file.
Open the “cert.pem” file in Notepad and remove the part of the file between (and including) the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines. Only leave the part starting with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----.
E.g.:
![](https://static.zohocdn.com/zoho-desk-editor/static/images/info.png)
-----BEGIN CERTIFICATE-----
MIIFLjCCBBagAwIBAgIKYTsAfQABAAAAwzANBgkqhkiG9w0BAQsFADBGMRUwEwYK
CZImiZPyLGQBGRYFbG9jYWwxFjAUBgoJkiaJk/IsZAEZFgZuYy1oZHgxFTATBgNV
BAMTDG5jLWhkeC1EQy1DQTAeFw0yNDA1MTMwOTM5MzFaFw0yNTA1MTMwOTM5MzFa
MCAxHjAcBgNVBAMTFVZTUy0yMDIyLm5jLWhkeC5sb2NhbDCCASIwDQYJKoZIhvcN
...
-----END CERTIFICATE-----
Open the “priv.key” file in Notepad and remove the part of the file between (and including) the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. Only leave the part starting with -----BEGIN PRIVATE KEY----- and ending with -----END PRIVATE KEY-----.
E.g.:
![](https://static.zohocdn.com/zoho-desk-editor/static/images/info.png)
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDlnYZxyKNch1r4
ElHRhC3qTew/l/ssOA6xTEQiFqLDSwU50ig5q2M0Rlyodb+vGYrUkbxnv9XanRld
fG5j4Ys4EX0fBIQBzMaT4f1s8eWLfos/EQQ5fLW+1jne98f+KftUG5RvTlG5FYVn
QlAZ++JKWkApTmCRk2IK2VKHFqDsgrshy0tXkpDfLK2Nwe2LKPqoDji2OYDegEXI
...
-----END PRIVATE KEY-----
Extracting the certificate and private key files with openssl on Linux
Transfer (with WinSCP or similar tool) the exported .PFX file into a Linux system and open a shell session there (e.g., connect via SSH with the PuTTY or any other SSH client).
If not yet installed, install the openssl toolkit using distribution-specific package management tool (apt, yum, etc.)
Use following commands to extract the certificate and the private key into Base64-encoded “cert.pem” and “priv.key” files:
![](https://static.zohocdn.com/zoho-desk-editor/static/images/info.png)
openssl pkcs12 -in /path/to/exported/certificate.pfx -out /path/to/extracted/cert.pem -nokeys
openssl pkcs12 -in /path/to/exported/certificate.pfx -out /path/to/extracted/priv.key -nodes -nocerts
When asked, provide the password which has been set when exporting the .PFX file.
Transfer the extracted “cert.pem” and the “priv.key” files back to the vSpace Manager machine.
To configure the NComputing vSpace Console Server service to use the custom certificate instead of the built-in one, the extracted certificate and unencrypted private key files need to be copied into the installation folder of the vSpace Console Server service. By default, it is: “C:\Program Files\NComputing\vSpace Manager Software\cmserver”. Copy the “cert.pem” and “priv.key” files into the installation folder of vSpace Console Server. As the private key file contains an unencrypted private key, appropriate security settings should be set on the “priv.key” file to prevent unauthorized users from accessing the file.
To set the file access permissions:
- Select the “priv.key” copied to the installation folder of the vSpace Console Server service, right-click it, and click the Properties option to open the priv.key Properties dialog.
- On the Security tab, click the Advanced button.
- On the Permissions tab of the Advanced Security Settings for priv.key dialog, click the Disable inheritance button:
![](https://support.ncomputing.com/galleryDocuments/edbsn47d6eebf7697739a6f539972749bb669bae97ca1bcd66f8dd6ba40b04458e6f560c1cab6671a0ef8a5b5de6e465d0c0d?inline=true)
- In the Block inheritance dialog, select the Remove all inherited permissions from this object option.
- Click the OK button to apply the changes and to close the Advanced Security Settings for priv.key dialog.
- Click Yes to confirm the change and to close the Windows Security warning. Upon this, no users no groups will have permission to access the “priv.key” file.
- In the priv.key Properties dialog, click the Edit… button.
- In the Permissions for priv.key dialog, click the Add… button.
- In the Select Users or Groups dialog, click the Locations… button.
- In the Locations dialog, select the topmost node representing the local computer (labeled with the computer name) and click the OK button.
- In the Enter the object names to select input area of the Select Users or Groups dialog, enter: “system; administrators” (without quotation marks) and click the Check Names button. The entered names should change to “SYSTEM; COMPNAME\Administrators” (where COMPNAME will be set to your vSpace Server name).
![](https://support.ncomputing.com/galleryDocuments/edbsn47d6eebf7697739a6f539972749bb66968106f33cb1fcd23e72c1f0f81b30192c45b498868a6f257ccd78f048a6b7e6c?inline=true)
- Click the OK button to apply the changes and close the dialog.
- For both added user groups, grant the Full control permissions:
![](https://support.ncomputing.com/galleryDocuments/edbsn37e9858596102db38ab1c12de1fbe781fc124d01fce039913fa8cba71c72d5f1eaec178d7ea309e965959a1a55245fea?inline=true)
- Click the OK button to apply the changes and to close the dialog.
- Click the OK button to close the priv.key Properties dialog.
With the above, only the members of the Administrators group and the local System account will have access to the “priv.key” file.
In the Services snap-in (services.msc) of Microsoft Management Console, restart the NComputing vSpace Console Server service (listed as NC vSpace Console Server) or reboot the vSpace Server running the vSpace Manager to wrap-up the configuration process. If the certificate and private key creation and extraction process was performed correctly, upon restart, the NComputing vSpace Console Server service will present to the connecting clients the new certificate.
To revert to the built-in self-signed SSL certificate, just remove the “cert.pem” and “priv.key” files from the CMServer.exe installation folder and restart the service or reboot the machine again.