ClickShare supports 3 different types of certificates that can be used for the ClickShare Configurator of the Base Unit & the REST API:
- Self-signed: ClickShare device will generate an internally self-signed key and certificate. This is the default behavior of all units. This results in the RED URL displayed in the browser location bar. If a verified Certificate Authority (CA) sign-in is required, the security section of the base unit provides a method to generate the certificate signing request (CSR) required by the CA to generate the verified certificate (see Single-domain certificate).
- Wild-card certificate: for multiple devices, you can obtain a wild-card certificate (e.g. *.barco.com) with an associated private key. This certificate can be signed by an official Certificate Authority (CA) or a self-managed CA. The certificate must be uploaded together with the associated private key in either the .pem format or the .p12/.pfx. In the latter case, an optional passphrase to protect the private key will also need to be entered in the wizard. This is done in the DNS server, the network assigns the Clickshare to the Wild-card domain (usually by MAC or IP).
- Single-domain certificate: to provision a device with a single-domain certificate, you first need to generate a Certificate Signing Request (CSR) on the device by selecting the appropriate wizard option. This will generate a private key in the background (stored securely on the device) and use the said key to sign the CSR. This CSR needs to be provided to the CA (official or self-managed), which will validate the details, and return a certificate if all details are correct. The resulting certificate needs then to be uploaded to Clickshare for activation. Note that the certificate needs to match the private key that was generated on the device! This means that uploading a single-domain certificate with the associated key is not allowed.
Note: More info upon X.509 can be found on https://en.wikipedia.org/wiki/X.509.
