HP LaserJet Pro Devices - Installing 2048 bit SSL certificates

Disclaimer

This document makes reference to certain products and/or services provided by third parties. These references are

provided for example and demonstration purposes only and are not intended as an endorsement of any products,

services, or companies.

Introduction

A recent publication of the National Institute of Standards and Technology (NIST Special Publication 800-131A)

announced that the use of 1024 bit SSL/TLS certificates is no longer recommended and will be “disallowed” after

December 31, 2013. The publication recommends the use of 2048 bit certificates to maintain network security and

integrity. As a result, most Certificate Authorities (CAs) will no longer issue 1024 bit certificates. And, most Web

browsers will no longer honor such certificates as safe and secure. In order to avoid error messages and the risk of a

security breach, systems and devices that rely on the SSL/TLS protocols will need to have 2048 bit Certificates installed.

Most HP LaserJet printers can accept a 2048 bit certificate but some cannot generate the request needed to obtain one.

This white paper will describe methods that can be used to obtain and install a 2048 bit certificate for such products. For

more detailed information on the SSL/TLS protocols and the use of certificates to provide Internet safety and security,

see “HP Jetdirect and SSL/TLS”.

There are three steps to this process:

1. Generate a Certificate Signing Request (CSR) for the printer

2. Obtain the certificate from a Certificate Authority (CA)

3. Import the certificate and private key into the printer

Generating a Certificate Signing Request

The normal process

Ordinarily, a certificate is obtained from a Certificate Authority (CA) by submitting a “Certificate Signing Request” (CSR).

This is a base 64 encoded text file which contains all the information needed by the CA to generate a certificate.

Most devices that employ the SSL/TLS protocols provide a method to accept appropriate input from the user and

generate a CSR. HP LaserJet printers are no exception. Those that support the SSL/TLS protocols include a page on their

Embedded Web Server (EWS) devoted to generating CSRs.

-----BEGIN NEW CERTIFICATE REQUEST-----

MIICyDCCAbACAQAwgYIxCzAJBgNVBAYTAkFOMREwDwYDVQQIEwhBbnlzdGF0ZTEQ

MA4GA1UEBxMHQW55dG93bjEOMAwGA1UECxMFU2FsZXMxGzAZBgNVBAoTEllvdXIg

Q29tcGFueSwgSW5jLjEhMB8GA1UEAxMYTlBJOTBEMDJCLnlvdXJkb21haW4uY29t

MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0FVz7Ixlt4LgXdAR3znK

fX9f9bSBQooaIp4d7jK5kT67fix+0Pr5W0/XakYb4J2d+rTFnamu6B5XRXqqKXsA

z1DlpVZ/cVMTk2fhLTuzhxG0KDeouvTgRtq+AYcTeY0CNZ2nzOERxEvPU70zKHcD

krhjm2fvHvcCNWMiz9CBCKVR3AtjMg90MJd9BoNMebyR8cf6IoAcgGaZ5bth7zkf

myvFz3p+YGQfPxqMOzifZlenTV00nyirjbK5jlPuQ/wzZiacPEAKmbVJD+XMt9+d

YxvWVtW3Z9JBpnHiH0YJwiFUzYyttRS+VL9FR5HDj+HrXaWMQ91X1BMSghDoIAK8

2wIDAQABoAAwDQYJKoZIhvcNAQEFBQADggEBAFuWVxEokMfPr8kThMO0usD0bGcR

TRikR/mG5nkJqhhnvfd/8slaCuMUcVBdw0fxWfQpyrHiiMP364DYoZkeweaa1nGc

viZyNhWQsGyM30G0H4OkNDXZQXi6X6GXvR0PwM/0aN7y94ki9mR2BOYmjNU9uPNZ

+xQ9kKERgsdmfZQpoEUq7rQ+gJiORU5rVzbn8XZtZlxKzJUT3dReD16Yy9W7v66V

TcS+B7nhqnggNGfz5x7Fex0pyjtb3OJ2i5QMY4ODTYtIrURDEuK5/50qSTRVYweE

d/hZi9HyzlDrEFkBd0VsUSKFsGPsrbDAK4JEHYoL1FxsNW3drBiGMApuKMk=

-----END NEW CERTIFICATE REQUEST-----