View Source

During installation we package in our own root CA plus internal Agent and IDP certificates. Some of our long-term customers may see this warning when updating the DualShield Framework

DualShield MFA Platform > How to Convert the DualShield Internal Root CA from 1024 bits to 2048 bits > Keystore_warnings.png

This is because the RSA key used in the installation of their original older version of DualShield Authentication Server would have been 1024 bit, which was acceptable at the time.

It is now recommended to update this key to 2048 Bits. There are quite a few steps to this process. All the instructions in this guide should be followed precisely.

Upgrade DualShield

Upgrade to DualShield 7.3.0 or later version, 7.3.4 is recommended.

Setup OAuth Agent Authentication

As a fail-safe it is advisable to enable OAuth on Single Sign-On and Admin Console Modules

On the Admin Console go to Authentication>Agents

Edit Single Sign-on Server

DualShield MFA Platform > How to Convert the DualShield Internal Root CA from 1024 bits to 2048 bits > Oauth5.png

In the edit screen select the OAUTH2.0 tab and click Generate Secrets

Keep this window open and edit the sso6.properties file which can be found in C:\Program Files\Deepnet DualShield\config.

For best results use notepad++ to edit the properties file.

For SSO6.Properties use the following template...

useOAuth=true

oauthClientId=#########################

oauthClientSecret=secret-##########################

oauthTokenUri=https://YourDualShieldFQDN:8071/das5/rest/oauth/token

Replace the hashes with the generated Client ID and Secret.

Replace the FQDN in the oauthTokenURI with your own backend server FQDN

This will be added into your SSO6.properties file as per the following example:

DualShield MFA Platform > How to Convert the DualShield Internal Root CA from 1024 bits to 2048 bits > Oauth8.png

Repeat the process for Admin Console agent, however you will be editing the dac.properties file and you will also be using this template:

useOAuth=true

oauthClientId=#########################

oauthClientSecret=secret-##########################

oauthTokenUri=https://YourDualShieldFQDN:8070/das5/rest/oauth/token

This will be added into your dac.properties file as per the following example:

DualShield MFA Platform > How to Convert the DualShield Internal Root CA from 1024 bits to 2048 bits > Oauth9.png

Notice also that only the Single Sign on module is using port 8071. This is specified in the sso6.Properties file.

oauthTokenUri=https://YourDualShieldFQDN:8071/das5/rest/oauth/token

The dac modules will use port 8070.

oauthTokenUri=https://YourDualShieldFQDN:8070/das5/rest/oauth/token

For further information on how oAuth2.0 works and how to enable it refer to: OAuth 2.0

Upgrade DualShield

Setup OAuth Agent Authentication

Regenerate the root CA

Regenerate all agents and idp certificates