Provide SSL Certificates (Optional)

Info: Bloomreach supplies SSL certificates for the bloomreach.cloud domain by default and can manage certificates for your custom domain using Let's Encrypt. If these options meet your requirements, proceed to Configure Domains.

Overview

This page describes how to securely provide your own SSL certificates to the Bloomreach Cloud team for installation on your stack.

When to Use

Provide your own SSL certificates if:

• You require a certificate authority other than Let's Encrypt.
• You need to use a certificate you have already purchased.
• You have compliance requirements that prevent using Bloomreach-managed certificates.

If you use only the bloomreach.cloud domain or accept Let's Encrypt for your custom domain, you do not need to provide your own certificates.

Prerequisites

• Access to your SSL certificate and private key in PEM format.
• The Bloomreach Cloud team's PGP public key (provided below).
• Access to the Customer Support Portal.

Implementation Steps

1. Prepare Certificate Files

• Create a PEM-formatted private key as a plain text file, unencrypted (no password). Example: yourdomain.key
• Create a PEM-formatted certificate as a plain text file. Example: yourdomain.cert
• If your certificate provider supplied intermediate certificates, append them to the certificate file in reverse order, after the primary server certificate. For guidance, see this example documentation.

2. Encrypt Certificate Files

• Encrypt both files (yourdomain.key and yourdomain.cert) using the Bloomreach Cloud team's PGP public key. The public key is available below and from popular key servers.
• You can use a tool such as PGP Tool to encrypt the files. Refer to the tool's FAQ for usage instructions.

3. Submit Encrypted Files

• Submit the encrypted files to Bloomreach Support via the Customer Support Portal.
• Bloomreach will delete the encrypted certificates from the support system after uploading them to your stack.

Verification

To confirm that your private key and certificate match, run the following commands. The output hashes must be identical.

openssl pkey -in privateKey.key -pubout -outform pem | sha256sum
openssl x509 -in certificate.crt -pubkey -noout -outform pem | sha256sum

If the outputs differ, the key and certificate do not match.

PGP Public Key

Info: Use the PGP public key for hippo-ondemand@bloomreach.com, fingerprint 53D6314B3FFD3D5587C1613A0884B4F0842336B7.

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFwFLOUBEAClGU63I1yh1uya4HXPThBDhO3QHFWPbhxupsFFJshYDj5hITEM
Tp/27bJujbhdnnE5ouNTHteFA3bIyCKTzdZN3/x5UMi4cy6Oon6jAv90zhDPtm5e
KULHE0Vi60k6NUyPy1PHyhs/jTMI1TNc8zNahOggOL/kJQd+EA0XSmOeQYs0uqBb
P7VsotoNiUeuW8BwIyR+zLztRTYFUOmRuf5VJYkj80JgS+iNnoDcqzEaGAJ3QGw3
DKytwDDRZV7O5GhksT76gGYBrmar4RfmwPRLopXRKJ9EKIVXW3wzN6UnEXQ9HmhJ
7U+fI9bmwRcpVky6Zy+sVlBGDsYDWJCOjMwhy4b+P2wkCYfppaqbpmHs8rab7dq/
U4ic+K0Fvv6CJKyT8MuFDv+wPIP9KtLphg4FvpFS1tRLJ0q5h/SZhkrHNcT7VYXa
/yxrHwO1yNUNkNXOdQZCeVz4GL82vsrZ/eiwXYF9mKtTKwev5vXkrKu3vXz5FmiG
ECMfDMgXow63LdtSHbEhg4VJOfR4gO9VBo0Tzxql/BuJLtypvaxxsuiTUIgw31WO
KKHF1BYZab87BN4ZxmvJ+0D1BvqCFwq3vwdmGlUBPpKbdNgAhTv2zv96wqT1wpkh
GnqUh8AI8aE7fvXmU2EmYJexLGymM97pixIEGiTyKi1J+VrNsgDMMAjx2QARAQAB
tDBCbG9vbXJlYWNoIENsb3VkIDxoaXBwby1vbmRlbWFuZEBibG9vbXJlYWNoLmNv
bT6JAk4EEwEKADgWIQRT1jFLP/09VYfBYToIhLTwhCM2twUCXAUs5QIbAwULCQgH
AwUVCgkICwUWAgMBAAIeAQIXgAAKCRAIhLTwhCM2t4/XD/9YD2q4hSuMBOM2bS8O
cYIDhe4dzO017CRwHBvPDcb/gRaL252nQqnCJCa9qKTxrcAZ6OBQ14vkb5LR0/g3
N5ZrViXPg/+uYH++FbCjX3/UXBnlgb3zO5S37a/V13i79zbP4EglRfMcvH/sE2o8
SwcgSH2BtW6yP2SsQIwbpnFMcfqunNo6pVPtBS/JvrqRod5CAp1yYSiT8qqEw6sj
+1BO9OOxHwuwUqJEY9MXLf8DyZaO15Gghyhsti3w6KIVdFJS2vuEY1Qrp31o0KIB
luQFeZtQ275aO92zkb79VJFVzRA10/yBsU7J59jv2j9LF0fnOxWlg6ks0Y3N18Rk
+yrBSJI5PQz5jD5zOIMk3lkU9XkzS3W6GWXDwO2s/NKOtgZtoyMp0Rk1z+Ddb2A5
aNDyOk5RgC4GJyMg6j+jMZzeqEKgBV6fdeNaCMiTI3S+L4B/Hkv6rqb/fup+hw/I
wyUlBExT0sZioFXAEYoPznJ8SiXsTkV1ZLB1PslcnFA8sEeMn/JidDXjh8wnKjOd
LK6ualpRLP6coicP3SkQkU1iGI2DgmHsKuxuYSnWJo9ENl6CAynOpDJMxpwBCAEb
owQMhcEgbdmKvE/VFs3lUm18iVmVFN9AtegYupdhJs5X9CLjmqLCtCytMI/XCL+k
rsKSOxTillQlbDNMOkUMQGpXxrkCDQRcBSzlARAAq1YP3cBTP4u+YeGBK28FDo1O
Pe+xXCzfqp6YFuvNRp4Yo84dbwZK+dOmEInABBKrOsUFdyH/nYumrzk4DkisDB8Z
vvO3gdss54F5AIIV8KsIeh4vSascoo6ZOt9GVBgMHfYqA9YgmyUB1kOhxVUp0yvp
HfKGTks6APnCngR3rGNj9RHYdus+TYQEZ2k/it6WxRyg4nrSncbEN+LqUETpoE5f
pDSxWV9xGBwXGTUk+ZdNyIJrTn9+b8ARGdJtmozCm6HaKJ4gzH4EwrzcGRt2nWbb
Z29RHDJ/d1ERUAV4fPFi2mupbOagGVuJ4fDvYJR3382diLrnDcu0q/3a4kvBDWcm
Id6TzvRjfxurUNQQLkW4W6xIG0A0QZWxcAdSneK8RA/7f86Xt46Iz55Bbit8uUPZ
YQtTj3UeOaEmB6p8dqje4fRTY0V8SwODZh8M56xziG2IoS30JZD2Bqyj3E1DqVc2
HEYLOmQZMfR15VWl2/eFLvFYPoP91so7tzQ4R+n/65I2RcadkzfNxTWDkr1H2WXv
0CZvJpGu+6gb6rgUbGUNsDo7CY/lbZn+FK+Hpuf6jXKNmRMlmzEUXkZDXYDl+ZjN
MiHU+UIV4eZ5LFLu76T4NMBv7uVeEYRRr3DT5BevGLCqipQ7KBph6P7c5dGPAVE0
ELQC62DvFQ52ah3ibvMAEQEAAYkCNgQYAQoAIBYhBFPWMUs//T1Vh8FhOgiEtPCE
Iza3BQJcBSzlAhsMAAoJEAiEtPCEIza3hgsP/i21a2/ndsTHOIXeGuHXSjCPXC1f
1HsAZ4z0SPTsKiz2vysVfYH6G4ftJumrF/PZB5MNItwLJ9MlsD+KlRX4TSN7sjxR
EwSVNVuN976S/WkYew7RqjK15Gs2Vz5ti7fZrarIs0p2xYlGZHuKHbg+cm+yt5pN
eQbLaGY4KGFczi/FnA0aNSKxRBQk6k1hO2sJsDXfIcY9AMw09vHx8fvEw6UIhExk
8IsE5mVBy6ybohMMfgUrVQED5LeGfzVB94fEMo34mwg6dEFVLPPStfI2ntk9mp2H
VIm2PiJj+38IMOITLQoQfhn7AOfDHxifOt+dat7BJBn2snsFkLkupf4kSB3krHql
PJHoDohQbI+2a2fFKmPLL7s+e8GIpFG8WqgCBz6CWLdjstL1TQTsMU6p3Odz90gP
BC1AbvM14lqgCyrtrhkS7jsbb2Soan25kOBo21Ako7aeVYamIalYmi4GJesEZo5C
o2m5cma2InPf99gXuoGvfvCuq1UP1BZbty93fCO4cBG0VPc7KYMNPc5rhVwS+C3V
/m24OzcBMMVW9nIvYBtlye4TLdq20oZDIhb2m9q8pFfWegxg330sNO7W43BhQeHG
6SgN45CXztvHFJCBFWhHA4hfKSbhkf2HFdQ6HFuC/yeFONrHLvqYg0qLnsIaTfcG
ckZPrUbsQRR1A/o7
=2MfL
-----END PGP PUBLIC KEY BLOCK-----