Installing Your Own SSL Certificate on the Cyfin / CyBlock Web Interface (Secure Interface)
Applies to: Cyfin and CyBlock · Area: Settings → Secure Interface
The Secure Interface screen and this procedure are the same in both Cyfin and CyBlock. Where they differ, it’s noted inline.
Is this the article you need? This explains how to install your own SSL/TLS certificate on the product’s web interface so that when you connect to the Cyfin/CyBlock console over HTTPS, your browser shows a valid, trusted certificate that matches your domain — no security warning.
The one distinction that matters here: accessing the UI vs. inspecting user traffic. This article is only about a certificate for accessing the admin console/UI over validated HTTPS. It has nothing to do with inspecting your users’ web traffic.
If you’re trying to inspect users’ HTTPS traffic instead, that’s SSL inspection — a different thing entirely:
- In CyBlock, SSL inspection is a proxy-only feature with its own screen: Settings → Proxy → SSL Certificates. Those are the client-authentication certificates the proxy uses to decrypt and inspect HTTPS traffic. That screen has nothing to do with reaching the UI, and it does not exist in Cyfin. If that’s what you want, go there — not the Secure Interface screen below.
- In Cyfin, SSL inspection isn’t a Cyfin screen at all; it’s enabled on your firewall — see the SSL Inspection article.
The common case: use your own certificate that matches your domain
By default, the product serves its web interface with a built-in Wavecrest certificate. Because that certificate isn’t issued to your domain by a CA your browsers already trust, connecting over HTTPS shows a “not secure” / name-mismatch warning.
Most customers therefore install their own certificate — one issued to the exact hostname they use to reach the console (for example cyfin.yourcompany.com or cyblock.yourcompany.com, or a wildcard like *.yourcompany.com). Once installed and enabled, browsers show a valid certificate and the padlock, with no warning.
There are two ways to do it, depending on what you already have:
- You already hold a certificate + private key issued to that hostname (for example a wildcard cert) → Option A.
- You need the product to generate a signing request for your CA to issue against → Option B.
Before you begin
- You’ll need administrator access.
- Have the fully qualified domain name (FQDN) users will use to reach the console.
- Your certificate and private key must be in PEM format.
- Installing or changing the interface certificate triggers an automatic service restart — plan a brief maintenance window.
Option A — Install a certificate you already have (PEM)
- Go to Settings → Secure Interface.
- Click the edit (pencil) icon next to Current Certificate.
- Under Certificate Type, select Custom.
- Paste your signed certificate into Certificate Data (PEM), then append your private key at the bottom of the certificate in the same field.
- Click Install. The product applies the certificate and restarts the service.
Continue to Enable the secure (HTTPS) connection.
Option B — Generate a CSR in the product and have your CA sign it
Use this when you don’t yet have a certificate and want your CA to issue one for the console hostname.
- Go to Settings → Secure Interface.
- Click Certificate Signing Request and complete the form:
- Domain Name (required) — the full domain of the server (for example
cyblock.yourcompany.com). - Country — 2-digit country code.
- State / City — if applicable.
- Organization — your organization name (defaults from the License screen).
- Email — the person responsible for the server (defaults to the current login’s email).
- Organization Units — optional departments/groups (for example “IT Group”); type next to New Unit and click +. Multiple units can nest (for example a “Security Audit” unit under “IT”). Remove All clears the box.
- Domain Name (required) — the full domain of the server (for example
- Click Generate. The product produces the CSR and private key in PEM format.
- Save the private key in a secure location, then forward the CSR to your CA for signing.
- When the CA returns your signed certificate:
- Return to Settings → Secure Interface and click the edit icon next to Current Certificate.
- Under Certificate Type, select Custom.
- Paste the signed certificate into Certificate Data (PEM) and append the private key you saved at the bottom.
- Click Install. The product applies the certificate and restarts the service.
Continue to Enable the secure (HTTPS) connection.
Enable the secure (HTTPS) connection
Installing the certificate is only half the job — you also enable HTTPS on the interface.
- In Settings → Secure Interface, configure the connection type.
- HTTP is enabled by default. Keep it (optionally changing the Port), or select Disable to turn it off.
- For HTTPS, select Enable to use a secure browser connection. The Port is prefilled with a recommended value; change it if needed.
- (Recommended the first time) Enable both HTTP and HTTPS so you can confirm the certificate loads before turning HTTP off.
- With both enabled, the Force HTTP to HTTPS Redirect option appears. Select Enable so HTTP visitors are redirected to HTTPS.
- Click Submit, then Continue to restart the service.
Verify
- Browse to
https://<your-console-domain>:<https-port>. - Confirm the browser shows the padlock and a valid certificate issued to your domain, with no warning.
- Check the certificate details to confirm it’s your certificate, not the default Wavecrest one.
CyBlock note: when switching from an invalid to a valid certificate, you may need to close and reopen the browser for the address bar to show the updated certificate status.
If you still see a warning, the usual causes are a domain mismatch (the certificate isn’t issued to the hostname you’re browsing to) or an untrusted signing CA — common with an internal/enterprise CA, whose root must be distributed to client machines so browsers trust it.
Alternative: keep the default Wavecrest certificate
If you don’t install your own certificate, you can instead distribute the built-in Wavecrest root so clients trust the default certificate. From Settings → Secure Interface, click Wavecrest Certificate to download the Root Certificate Authority, and see the Wavecrest Certificate Installation Guide for how to install/distribute it. Most customers prefer their own certificate (above) because it matches their domain and validates without extra client-side distribution.