Note - Above fields are placeholders only for signed Certificate, and MarkLogic mainly uses above fields to generate Certificate Signing Request (.csr). For Certificate request generated by 3rd party tool, it does NOT matter if template field matches exactly with final signed Certificate or not.

Once we have Signed Certificate imported, App Server will use the Signed Certificate, and the SSL Client will only see field values from the Signed Certificate (even if they are different from Template Config page ).

2) Create an HTTPS App Server

Please follow Procedures for Enabling SSL on App Servers except for the "Creating Certificate Template" part as we have created the Template to match our existing pre-signed Certificate. 

3) Verify Pre-signed Certificate and Private Key file 

Prior to installing a pre-signed certificate and private key the following verification should be performed to ensure that both certificate and key are valid and are in the correct format. 

* Generate and display the certificate checksum using the OpenSSL utility

[admin@sitea ~]# openssl x509 -noout -modulus -in cert.pem | openssl md5

(stdin)= 2ddd2ca48ad2eb4eba082f5da3fd33ab

* Generate and display the private key checksum

[admin@siteaa ~]# openssl rsa -noout -modulus -in key.key | openssl md5

(stdin)= 2ddd2ca48ad2eb4eba082f5da3fd33ab

The checksum from both commands should return identical values, if the values do not match or if you are prompted for additional information such as the private key password then the certificate and private keys are not valid and should be corrected before proceeding.

Note: Proceeding to the next step without verifying the certificate and the private key could lead to the MarkLogic server being made inaccessible. 

Advisory: Private Key's with a key length of 1024 and less are now considered insecure. When generating a Private Key you should ensure a key length of 2048 or higher is used.

4) Install Pre-signed Certificate and Key file to Certificate Template using Query Console

Now since Certificate was pre-signed, MarkLogic does not have a key that goes along with that Pre-signed Certificate. We will install Pre-signed Certificate and Key into MarkLogic using below XQuery in Query Console.

Note: Query Must be run against Security Database. 

Please change the Certificate Template-Name, and Certificate/Key File location in below XQuery to reflect values from your environment.

xquery version "1.0-ml";
import module namespace pki = "http://marklogic.com/xdmp/pki" at "/MarkLogic/pki.xqy";
import module namespace admin = "http://marklogic.com/xdmp/admin" at "/MarkLogic/admin.xqy";

(: Update Template name for your environment :)
let $templateid := pki:template-get-id(pki:get-template-by-name("TemplateName"))
(: Path on the MarkLogic host that is readable by the MarkLogic server process (default daemon) :)
(:   File suffix could also be .txt or other format :)
let $path-to-cert := "/cert.pem"
let $path-to-key := "/key.key"

return
pki:insert-host-certificate($templateid,
  xdmp:document-get($path-to-cert,
    <options xmlns="xdmp:document-get"><format>text</format></options>),
  xdmp:document-get($path-to-key,
    <options xmlns="xdmp:document-get"><format>text</format></options>)
)