[amistry@engrlab18-128-026 PreSignedCert]$ openssl x509 -in ML.pem -text 
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 7 (0x7)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=CA, L=San Carlos, O=MarkLogic Corporation, OU=Engineering, CN=MarkLogic CA
        Validity
            Not Before: Nov 30 04:12:33 2015 GMT
            Not After : Nov 29 04:12:33 2017 GMT
        Subject: C=US, ST=NJ, L=Princeton, O=DemoLab Corporation, OU=Engineering, CN=presigned.engrlab.marklogic.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)

For above Certificate we will create below Custom Template in Admin GUI -> Configure-> Security -> Certificate Template  Create Tab as below.

We will save our new template as - "DemoLab Corporation Template"

 

Note—The above fields are placeholders only for signed Certificates, and MarkLogic mainly uses them to generate Certificate Signing Request (.csr). For a Certificate request generated by a third-party tool, it does NOT matter if the template field matches exactly with the final signed Certificate.

Once we have imported the Signed Certificate, the App Server will use it, and the SSL Client will only see field values from the Signed Certificate (even if they are different from those on the Template Config page ).

2) Create an HTTPS App Server

Please follow the Procedures for Enabling SSL on App Servers except for the "Creating Certificate Template" part, as we have created the Template to match our existing pre-signed Certificate.

3) Verify Pre-signed Certificate and Private Key file 

Before installing a pre-signed certificate and private key, the following verification should be performed to ensure the certificate and key are valid and in the correct format. 

* Generate and display the certificate checksum using the OpenSSL utility

[admin@sitea ~]# openssl x509 -noout -modulus -in cert.pem | openssl md5

(stdin)= 2ddd2ca48ad2eb4eba082f5da3fd33ab

* Generate and display the private key checksum

[admin@siteaa ~]# openssl rsa -noout -modulus -in key.key | openssl md5

(stdin)= 2ddd2ca48ad2eb4eba082f5da3fd33ab

The checksum from both commands should return identical values; if the values do not match or if you are prompted for additional information, such as the private key password, then the certificate and private keys are not valid and should be corrected before proceeding.

Note: Proceeding to the next step without verifying the certificate and the private key could make the MarkLogic server inaccessible. 

Advisory: Private keys with a key length of 1024 and less are now considered insecure. When generating a private key, you should ensure that a key length of 2048 or higher is used.

4) Install the Pre-signed Certificate and Key file to the Certificate Template using Query Console

Now, since the Certificate was pre-signed, MarkLogic does not have a key that goes along with it. We will install the Pre-signed Certificate and Key into MarkLogic using the below XQuery in the Query Console.

Note: Query Must be run against Security Database. 

Please change the Certificate Template Name and Certificate/Key File location in the below XQuery to reflect values from your environment.

xquery version "1.0-ml";
import module namespace pki = "http://marklogic.com/xdmp/pki"" at "/MarkLogic/pki.xqy";
import module namespace admin = "http://marklogic.com/xdmp/admin"" at "/MarkLogic/admin.xqy";

(: Update Template name for your environment :)
let $templateid := pki:template-get-id(pki:get-template-by-name("TemplateName"))

(: Path on the MarkLogic host that is readable by the MarkLogic server process (default daemon) :)

(:   File suffix could also be .txt or other format :)
let $path-to-cert := "/cert.pem"
let $path-to-key := "/key.key"

return
pki:insert-host-certificate($templateid,
  xdmp:document-get($path-to-cert,
   <options xmlns="xdmp:document-get"><format>text</format></options>),   xdmp:document-get($path-to-key,
<options xmlns="xdmp:document-get"><format>text</format></options>)
)

 Above will associate our pre-signed Certificate and Key into the Template created earlier, which is linked to the HTTPS App Server.

Important note: pki:insert-trusted-certificates can also be used in place of pki:insert-host-certificate in the above example.