Replacing the autogenerated SSL certificate

By default,

BEMS

is remotely accessible using HTTPS only. During installation, a

BEMS

Java

keystore called bems.pfx is created and located in

<

drive

>\Program Files\BlackBerry\BlackBerry Enterprise Mobility Server\Good Server Distribution\gems-quickstart-<

version

>\etc\keystores\

. If you previously replaced the self-signed certificate, then your existing certificate and certificate password are retained. You can replace the previously self-signed certificate using a SAN certificate or a Wildcard server certificate and assign the certificate to be used by all nodes in a cluster. When you replace the previously self-signed certificate with a SAN or Wildcard server certificate, makes sure that the certificate is trusted by all

BlackBerry Dynamics

apps that communicate with

BEMS

on port 8443.

For instructions, see Assign the BEMS SSL certificate to users.

When you replace the auto-generated SSL certificate, you perform one of the following actions based on your organization's needs:

Environment	Action
One BEMS instance	Upload and replace the auto-generated SSL certificate with a SAN or Wildcard certificate and assign the certificate for use by all nodes in the cluster.
Multiple BEMS instances that share a cluster certificate.	Upload and replace the auto-generated SSL certificate with a SAN or Wildcard certificate and assign the certificate for use by all nodes in the cluster.
Multiple BEMS instances and each instance requires an independent certificate that is issued by a certificate authority.	Upload and replace the auto-generated SSL certificate with a self-signed certificate for a single node.