Set up the certificates
Sitecore Experience Platform is designed to be secure by default. You must therefore implement HTTPS across the platform.
Server Certificate Authentication
All communication between Sitecore instances occurs over the default HTTPS configuration. This includes the Sitecore Identity server, and the Solr search provider. HTTPS requires that you obtain and set up certificates for the Secure Sockets Layer (SSL) before you install the platform.
Server authentication uses a server-side certificate and a private key to encrypt traffic between the HTTP client and the HTTP server application. This type of authentication prevents unencrypted content from traveling over an unsecured network. It does not identify who the client is and the server authentication alone does not determine who can connect to the server.
In local developer environments, self-signed certificates can be used to develop Sitecore solutions. Due to potential security concerns, you must not use self-signed certificates in production environments.
Set up server certificate SSL authentication on IIS
You must obtain and install the server certificates before you run SIF. For more information about how to set up SSL in IIS, see Microsoft’s documentation.
The following table lists the full set of server authentication certificates for this topology:
| XM Scaled (XM1) | ||
|---|---|---|
| Content Management Sitecore Identity server |
For each certificate, you must use the site name in the common name CN field in the certificate. For example, if the name that you want to use for the Content Management IIS site is CM_test, you must use this name when you create the Content Management certificate.
Starting with Sitecore 10.0.1, the Content Delivery server role comes with the HTTPS protocol enabled by default.
If you need to deploy a CD server role that uses the HTTP protocol, you can change the protocol. To use the HTTP protocol, before you deploy the CD server role, in the sitecore-XP1-cd.json file, set the DisableHttpsForCD parameter to true.
Install the server certificates
After you obtain the relevant certificates, you must install them.
To install the server certificates:
-
Install the server authentication certificate in the system certificate store folder:
For information about how to install a private key certificates, see PowerShell Import-Certificate from Microsoft.
-
If you created a self-signed certificate, install the self-signed authority certificate for the SSL certificate in the following folder:
For the XM Scaled topology, it is assumed that there is only one SSL certificate for each IIS instance that covers multiple application roles. For XM Scaled (XM1), there is a dedicated role per server in a distributed setup, and you must obtain and install a certificate for each server role.