PaperCut - SSL

[Edu-IT]

Has anyone used LetsEncrypt with PaperCut for SSL? Or, does anyone else have a suggestion for a cheap SSL?

[NetworkNinja]

I have always used Comodo for SSL Certificates.

 

https://comodosslstore.com/

[3s-gtech]

I've been hugely impressed with Comodo, and I have used LE before. For LE to work, it needs to be able to resolve that server via 80 and 443 (I think!), the scripts to do that are easy enough but how you then import the cert into PaperCut without having to do it manually every three months I'm not sure. Even Comodo's certs only last twelve months now.

[pete]

We do. Unfortunately (given the use of java keystores for the cert), automating the renewal is something of a faff and I haven't got that sorted yet.

 

Mobiliity Print (on the other hand) doesn't use Java keystores and it's simply a case of replacing the cert & key in the filesystem and restarting the service.

 

LE doesn't need the server to be externally accessible if you use DNS to verify the cert - you just need to be able to create a "printserver.int.yourdomain.whatever" record in DNS, obtain the cert, then remove the record. Cloudflare or another DNS provider that allows API access makes that part easy at least.

[Edu-IT]

Did anyone figure out LE and PaperCut?

[Steve21]

Did anyone figure out LE and PaperCut?

 

In what regards? We use it for it, but you can't really automate it due to the acceptance on the printers for the new certs etc

 

Steve

[Edu-IT]

So do you just renew it every 3 months?

[Steve21]

So do you just renew it every 3 months?

 

So the cert renewal is automated as per the normal route (We use Certify but whichever you use), which also automatically exports the cert with private key etc

 

I then have the Import commands all ready in a BAT file to re-run, at a time we choose (normally half-term/holidays etc), as we reuse the same passwords etc so you can just import it without overriding the settings in papercut files etc

 

First we auto copy the file from the server doing the renewal to the print server e.g. \\PRINTSERVER\c$\Program Files\PaperCut MF\server\custom

 

Then from a CMD/PS file set to run within "C:\Program Files\PaperCut MF\runtime\jre\bin"

 

You can automate the import into the keystore using:

keytool -importkeystore -srckeystore "C:\Program Files\PaperCut MF\server\custom\Papercut.pfx" -srcstoretype pkcs12 -destkeystore "C:\Program Files\PaperCut MF\server\custom\my-ssl-keystore"

 

As long as the exported keys match what was in the papercut config file no changes required, and then auto-restart services

 

Basically only bit to manually do is the acceptance on the printers which is normally done over the half-term/holidays where it falls into it, else a quick 1st thing on a Monday morning job

 

Steve

[Edu-IT]

I think I may be being stupid, but, where do you download the certificate from when you've got as far as requesting it in Certify and it says Expires in 89 days? @Steve21 Edited November 1, 2021 by Edu-IT

[Steve21]

I think I may be being stupid, but, where do you download the certificate from when you've got as far as requesting it in Certify and it says Expires in 89 days? @Steve21

 

By default on Windows it’d be in your Cert store (personal) on the computer unless you’ve set it to do any exports etc

 

Run mmc and add in Certificate plugin etc (as computer account )

 

Steve

[Edu-IT]

Is that controlled by the Deployment tab? In there it’s set to do nothing. What should it be?

[Steve21]

Ah if you have nothing set at all, not even to cert store it'd be in ProgramData\certify\assets"certname etc"

 

In regards to what you want set, what exactly are you trying to do? Like is this renewed on the same machine? a different server?

 

Papercut doesn't use the default store, it uses it's own java keystore, so the original bit doesn't make much difference where you put it whether to store/programdata etc, it's just based on whatever place you put it to export from in your script

 

Steve

Edited November 1, 2021 by Steve21

[Edu-IT]

That makes sense, thanks.

[Edu-IT]

I keep getting 'keystore password was incorrect' however this is the password I use to open in KeyStore explorer and also what is within the config file for PaperCut. The password works in KeyStore explorer.

 

Should I have set a new keystore password when I generated the SSL in Certify The Web?

 

Could it be the wrong source store type or all they all pkcs12?

Edited November 2, 2021 by Edu-IT

[diedux]

A bit late response. Had this issue before. Now, I always set Keystore AND certificate password to be the same. Never had issues since.As for LetEncrypt, even if someone finds an automated way to update the PaperCut Keystore with a new certificate, in many cases, you would still face a problem automating new certificate registration on the PaperCut Devices.