Requirements

• Admin access to the Commander application server
• Access to update DNS for txt based validation
• A maintenance window in which you can restart the Commander service

Installing Certbot on the Commander Application Server

1. Download Certbot and install it on the Commander application server. 
2.  Run the installer and complete the Wizard.

Requesting the Certificate Using Certbot and DNS Validation

1. Run either cmd  or powershell as an administrator.

2. Issue the command that follows to confirm that Certbot has installed correctly:

certbot -version

3. Login to your DNS provider and create the associated txt record for validation. Verify that the txt record has been propogated using a tool suchs as MXToolbox or Google Admin toolbox before continuing. 
4. Issue the following command, updated with your email and the Commander application server FQDN, to request a certificate:

certbot --text --agree-tos --email you@domain.com -d commander.domain.com --manual --preferred-challenges dns --expand --renew-by-default  --manual-public-ip-logging-ok certonly

4. Hit ENTER to generate the certificate files, which will be created under C:\Certbot\archive\[FQDN]\ if you used the default path during installation. 
5. Copy these files to ..\Embotics\Commander\tomcat\conf\ as shown below. 

6. Make a backup of your server.xml file in the same directory, and open the original in a text editor. Make the following edits:
   • Locate and comment out the HTTP port 80 connector
   • Locate and comment out the existing SSL connector

• Paste into a new line a connector specifying the certificates files, making sure the .pem file names match those in your \tomcat\conf directory. 

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="500" compression="on" scheme="https" SSLEnabled="true" secure="true" >
	<SSLHostConfig protocols="TLSv1.2"				    ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA" >
        <Certificate certificateFile="conf/cert.pem" certificateKeyFile="conf/privkey.pem" certificateChainFile="conf/chain.pem" />
    </SSLHostConfig>
</Connector>

7. Save your changes and restart the Commander Windows service. Once the service initializes, you should see the new certificate. If you do not, you may need to clear your browser cache.