Knowledge Base

Security Certificates

Working with Security Certificates

We advise to use a secure connection when using the Viso WebApp. This is possible with a HTTPS certificate, which is necessary to safely identify the server.

Using HTTPS certificates fulfills two main requirements:

• Encrypted communication between user and server computers
• Server authentication

To obtain a HTTPS certificate, choose one of the following options:

1. Buy a certificate from a Certification Authority — This is the recommended solution. The Viso Web Server and clients must have public internet access. You do not have to install the server certificate locally, it is authorized by a third-party.
2. Use a self-signed certificate — Noldus provides a tool to generate a self-signed certificate. Every user has to install the certificate manually as a trusted certificate. See Create a Certificate with the Noldus Tool.
3. Use a previously used certificate — If Viso is reinstalled or upgraded, and previously a certificate was used. See Use a Certificate from a Previous Viso Version.
4. Use the default, installed certificate — Viso installs a default HTTPS certificate for the reverse proxy (Nginx) server. This certificate is a self-signed one, issued to and by Noldus IT (NIT). This solution is not recommended. You have to manually accept the certificate warning. The communication is encrypted, without server authentication.

Create a Certificate with the Noldus Tool

The X509 certificate creator tool is a self-signed certificate generation tool, implemented by Noldus IT. Follow the steps below if you want to use a self-signed certificate.

1. Download the X509CertificateCreator folder via your MyNoldus account. You can find the folder in the Drivers & Tools section. Browse to my.noldus.com if you do not have a MyNoldus account yet.
2. Copy the folder to the Viso Viewer PC.
3. Right-click the bat batch file in the folder and run it as administrator. You will get a message that the Viso Reverse Proxy will be stopped temporarily and therefore all viewers and web clients may be unresponsive for a short while.
4. Press any key to start configuring the settings.
5. When prompted for a previously created certificate:
   • Press y if you upgraded from an earlier version of Viso and used a certificate in the earlier version. See Use a Certificate from a Previous Viso Version for the steps to follow.
   • Press n to create a new certificate.
6. Specify the certificate name (certificate subject name) without path or extension. Use the name of the Viso Services computer as the name for the certificate, for instance, VisoLab.
   • To find the Viso Services computer name: click the Windows icon and type system, then click System Information. You will find the name under System Name.
7. Press Enter when prompted for (comma separated) certificate subject alternative names.
8. Press Enter when prompted for a certificate friendly name.
9. Press Enter when prompted for a certificate PFX password. The certificate will be created and will have the name that you specified in step 6. You will find the three certificate files (*.crt, *.key and *.pfx) in C:\ProgramData\Noldus\Viso Services\12.
   • By default, the ProgramData folder is a hidden folder. To make it visible in Windows Explorer, click the View tab at the top of your screen and select the Hidden items checkbox.
10. Press Enter when prompted for the Reverse Proxy Port. The Viso Reverse Proxy Service is started again and you will get a message informing you that the restart was successful.
11. Press any key to close the window.

Copy Your Certificate to the Appropriate Folder

1. Click the Windows icon in your taskbar and type certificate.
2. Click Manage computer certificates.
3. Double-click on Personal in the list on the left.
4. Right-click on the Object Type field on the right and click All Tasks and then Import. The Certificate Import Wizard opens.
5. Click Next in the Welcome window and browse to your certificate in C:\ProgramData\Noldus\Viso Services\12.
6. Select the Security Certificate (*.crt) that you created in Create a Certificate with the Noldus Tool. Click Open and then Next.
7. Select Place all certificates in the following store. Select Personal and then click Next and Finish. You will get a message that the import was successful. Click OK.
8. Double-click the Personal > Certificates folder and check that your certificate is there.
9. Make sure that both the Certificates folder under Personal and the one under Trusted Root Certification Authorities are visible.
10. Drag your certificate from the Personal > Certificates folder to the Trusted Root Certification Authorities > Certificates folder.

Check Whether You Have a Secure Connection

1. Open Google Chrome or another web browser and type https://<System Name Viso Services PC>:5001 in the address field and press Enter. The Viso login page opens and the lock icon shows that the connection is secure.

Enable Your Certificate on Other PCs with Viso Viewer

1. Open Google Chrome or another web browser and type https://<IP address Viso Services PC>:5001 in the address field and press Enter.
2. Click on Not secure in the address field and then on Certificate is not valid. The Certificate Viewer window opens.
3. Click the Details tab. The certificate that you created with the Noldus tool is listed under Certificate Hierarchy.
4. Select the certificate name and click Export.
5. Browse to the location on your PC where you want to save the certificate.
6. From the Save as type drop-down list select Base64-encoded ASCII, single certificate (*.pem;*.crt) and click Save.
7. Follow the steps under Copy Your Certificate to the Appropriate Folder.
8. Then check whether you have a secure connection.

Use a Certificate from a Previous Viso Version

If you upgraded from an earlier version of Viso and used a certificate in that version, you can use the certificate for Viso 12. You can find the certificate on the Viso Services PC in C:\ProgramData\Noldus\Viso Services\<Viso version number>.

1. Copy the certificate files (*.crt, *.key and *.pfx) from the old Viso version folder to the Viso 12 folder.
2. Copy your certificate to the appropriate folder.
3. Check whether you have a secure connection.

Compatibility

Using the description above, you can safely use the Viso Web App via HTTPS from Chrome on Windows desktop. On other platforms, the procedure may be different:

• macOS: Use the following method (see the 'Add Certificate to Trusted Root Authority' section): http://www.andrewconnell.com/blog/updated-creating-and-trusting-self-signed-certs-on-macos-and-chrome
• iOS: If you accept the self-signed certificate once, the page will be loaded as trusted next time.
• Android: The warning message remains even if the self-signed certificate is accepted or installed from the exported .cer/.crt file. On Android 7.1, you can use the page with the warning, but on older systems it is possible that you cannot use the Viso Web App due to the untrusted certificate.

Using HTTP Instead of HTTPS

If security is not a concern you can use HTTP instead of HTTPS. This may, for instance, be necessary if you use a programmable button to start and stop session recording in Viso. Programmable buttons work with HTTP commands, not with HTTPS commands.

To use HTTP:

1. Open the folder C:\ProgramData\Noldus\Viso Services\12 and open the file Viso.Web.SSL.config in Notepad or a similar text editor.
   • By default the ProgramData folder is a hidden folder. In Windows Explorer on the View tab, select Hidden items in the Show/hide section to view the folder.
2. Change the first two lines in the file from:

   # Define HTTPS port
   listen 5001 ssl;

   to:

   # Define HTTP port
   listen 5001;

3. Open Task Manager by clicking the Windows button on your keyboard and typing Task Manager in the search field. In the Task Manager window, click the Services tab.
4. Right-click VisoReverseProxyService and click Restart.
5. Right-click VisoWebServer and click Restart. Then close the Task Manager.

Source: Viso 12 Setup Manual - Security Certificates, Noldus Information Technology