This communication link is encrypted by default. However, the pre-installed certificate cannot have the correct IP address/domain name of your machine where FlexiSpooler is installed and thus it is ignored on the client side (FlexiSpooler in the client mode, Mobile Print Server, Mobile Integration Gateway). In order to ensure secure connection, you need to use certificate trusted in your environment.

This guide will help you with the configuration of the secured connection (HTTPS) to the FlexiSpooler in the server mode, using a CA-signed certificate.

CA-signed certificate requirements

• The certificate must be signed by a certification authority trusted in your environment.
• Certificate (fields Common Name and Subject Alternative Name) must contain all network names (i.e. all hostnames, fully qualified domain names and IP addresses) used for connection to the FlexiSpooler in server mode.
• For importing the certificate you need it in an appropriate format - Personal Information Exchange (.pfx file) containing the private key and whole certificate chain.

Configuring Server FlexiSpooler to use secure communication channel

In the <fsp_folder>\Service\spooler.config (usually C:\DispatcherParagon\FSP\Service\spooler.config) configuration file specify the certificate source by adding or modifying configuration option dsCertificateSource.This option has three possible values (all case insensitive):

• Default - default certificate provided with Dispatcher Paragon
• WindowsCertStore - finds certificate in Windows Certificate Store
• FileSystem - tries to find certificate on local or network storage

Windows Certificate Store

1. Stop the Dispatcher Paragon FlexiSpooler service.
2. Copy your key/certificate in the Personal Information exchange format to the server where the FlexiSpooler is installed.

3. Import the key with signed certificate to Windows Certificate store.
   In Windows Server 2012 use the following command:

   certutil.exe -importpfx "My" "dispatcherparagoncertificate.pfx"

   In Windows Server 2008 use the following command:

   certutil.exe -importpfx "dispatcherparagoncertificate.pfx"

4. In the <fsp_folder>\Service\spooler.config (usually C:\DispatcherParagon\FSP\Service\spooler.config) configuration file add or modify following configuration options:

   "dsCertificateSource":"windowscertstore",

   "dsCertificateStore":"my",

   "dsCertificateStoreIdentifier":"000102030405060708090a0b0c0d0e0f10111213"

   Configuration option dsCertificateStoreIdentifier is used for specification of certificate in selected certificate store. The certificate in store can be specified by its  name  (value entered in Common Name (CN) field when generating a certificate signing request) or by its unique thumbprint , which can be obtained by double-clicking the certificate and browsing the Details tab for Thumbprint field. In case you are copying certificate thumbprint from the window, remove spaces and make sure there are no invisible characters (it adds an invisible character at the beginning!).

5.  Start the Dispatcher Paragon FlexiSpooler service.

File system

1. Stop the Dispatcher Paragon FlexiSpooler service.
2. Copy your key/certificate in the Personal Information exchange format to the server where the FlexiSpooler is installed.

3. In the <fsp_folder>\Service\spooler.config (usually C:\DispatcherParagon\FSP\Service\spooler.config) configuration file add or modify following configuration options:

   "dsCertificateSource":"filesystem",

   "dsCertificateFileSource":"absolute\path\to\your\certificate.pfx"
   FlexiSpooler loads certificate from filesystem. This certificate is automatically installed into Windows Certificate Store specified by configuration option dsCertificateStore.

   To specify location of file on local disc or network storage, configuration option  dsCertificateFileSource  must be provided.  Path to the certificate can be specified as follows:

   • Full path to certificate file - e.g. C:\Certificates\fsp.pfx
   • Directory containing certificate -  e.g. C:\Certificates, first .pfx file found in this directory is taken
4. Start the Dispatcher Paragon FlexiSpooler service.

Client FlexiSpooler settings

In the <fsp_folder>\Service\spooler.config (usually C:\DispatcherParagon\FSP\Service\spooler.config) configuration file set the following property to validate the server certificate:

Mobile Print Server settings

In the <mps_folder>\Service\conf\mps.config (usually C:\DispatcherParagon\MPS\Service\conf\mps.config) configuration file set the following property to validate the server certificate:

Mobile Integration Gateway settings

In the <mig_folder>\bin\MigService.exe.config file (usually C:\DispatcherParagon\MIG\bin\MigService.exe.config) edit the following key to enable certificate validation:

Notes

This setting provides server verification only. Without verification of the client anyone in the internal network is able to call and use FlexiSpooler web API. Find more at Dispatcher Paragon FlexiSpooler Security considerations.