Changing a licensed SendPro Enterprise instance from HTTP to HTTPS

This article applies to licensed SendPro Enterprise users only, not subscribers. If you are a subscriber, your SendPro Enterprise is hosted in the Pitney Bowes cloud with the address https://name.sendproenterprise.com, where "name" is your organization's unique value. If you are a licensed user, your SendPro Enterprise is not hosted in the Pitney Bowes cloud.

Beginning with version 8.45, SendPro Enterprise prohibits HTTP implementations; all instances must use HTTPS. These instructions describe changing an existing HTTP instance of SendPro Enterprise to use HTTPS. It is highly recommended that instances below 8.45 are first configured for HTTPS before they are upgraded.

• Step 1: Create Self-Signed Certificates
• Step 2: Import Certificates into Trusted Root Certification Authorities
• Step 3: Prepare SendPro Enterprise Components
• Step 4: Configure SendPro Enterprise
• Step 5: Update Site Binding
• Step 6: Update Workstations

Step 1: Create Self-Signed Certificates

Ignore this section if certificates will be provided by a CA. It is crucial, however, that each certificate issuer value matches exactly the hostname for the matching instance.

1. Open SendPro Enterprise Setup (Instance Manager).
2. Navigate to SendPro Enterprise Instances.
3. Record the hostname value in the Binding Settings section for each instance.
4. Navigate to HubCapp Instances.
5. Record the hostname value in the Binding Settings section for each instance.
6. Close SendPro Enterprise Setup.
7. Run Powershell as an administrator.
8. For each certificate to be created, execute the command below, making certain to replace [SPEhostname] and [HubCapphostname] with the hostname values of the instances for which the certificate is being created.
   Important: The values must exactly match the hostname values of the SendPro Enterprise and HubCapp instances shown in SendPro Enterprise Setup.
   New-SelfSignedCertificate -DnsName "[SPEhostname]", "[HubCapphostname]" -Subject "CN=[SPEhostname], CN=[HubCapphostname]" -KeyAlgorithm RSA -KeyLength 2048 -CertStoreLocation "Cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(10)
9. In Windows Search, start typing Manage Computer Certificates, then select it from the search results.
10. Navigate to Certificates - Local Computer > Personal > Certificates.
11. Export each certificate that you created in step 8:
    1. Right-click on the certificate.
    2. Select All Tasks > Export.
    3. Select Next.
    4. Select No, do not export the private key.
    5. Select Next.
    6. Select DER encoded binaryX.509 (.CER).
    7. Select Next.
    8. Select Browse to specify a name and location in which to store the file. Keep this information for later.
    9. Select Save.
    10. Select Next.
    11. Select Finish.
    12. Select OK at the confirmation prompt.

Step 2: Import Certificates into Trusted Root Certification Authorities

1. In Manage Computer Certificates, navigate to Trusted Root Certification Authorities > Certificates.
2. Repeat the following for each certificate that you exported earlier:
   1. Select Action > All Tasks > Import.
   2. Select Next.
   3. Select Browse. Locate and select the certificate to be imported.
   4. Select Open.
   5. Select Next.
   6. Select Place all certificates in the following store: Trusted Root Certification Authorities.
   7. Select Next.
   8. Select Finish.
   9. Select OK at the confirmation prompt.

Step 3: Prepare SendPro Enterprise Components

1. Open a text editor (Notepad, Notepad++, etc.) as an administrator.
2. Assuming the default installation path, open C:\ProgramData\SendPro Enterprise Setup\Server Configuration.xml.
3. Using the editor's search and replace tool, search for each occurrence of <UseSSLBinding>false</UseSSLBinding> and replace it with <UseSSLBinding>true</UseSSLBinding>.
4. Save and close the file.
5. Assuming the default installation path, open C:\Program Files (x86)\SendPro Enterprise Installation\Instance Manager.ps1.
6. Using the editor's search and replace tool, search for each occurrence of $AddSSLCertToWebBinding.AddSslCertificate($thumbprint, $storage); and replace it with #$AddSSLCertToWebBinding.AddSslCertificate($thumbprint, $storage);.
7. Save and close the file.
8. Close the text editor.

Step 4: Configure SendPro Enterprise

1. Open SendPro Enterprise Setup.
2. For each instance of SendPro Enterprise and HubCapp:
   1. Navigate to the instance.
   2. Expand the SSL Certificate section.
   3. In Windows Search, start typing Manage Computer Certificates, then select it from the search results.
   4. Double-click the certificate for the matching instance to view the Properties window.
   5. Select the Details tab.
   6. Select Issuer.
   7. Highlight the Issuer value, ignoring "CN = ", and copy it to the clipboard.
   8. Return to SendPro Enterprise Setup.
   9. Paste the Issuer that you copied from the certificate into the Issued By field. Confirm that the value matches exactly the instance's hostname value.
   10. Return to the certificate Properties window.
   11. Select Serial Number.
   12. Highlight the Serial Number value and copy it to the clipboard.
   13. Return to SendPro Enterprise Setup.
   14. Paste the Serial Number that you copied from the certificate into the Serial Number field.
   15. If multiple certificates are being used, set Require Server Name Indication to True.
   16. For Storage, enter My.
3. Once all settings are applied, select File > Save.
4. Select Install > Run Now.
5. When the message Installation complete appears, close SendPro Enterprise Setup.

Step 5: Update Site Binding

1. In Windows Search, start typing Internet Information Services (IIS) Manager, then select it from the search results.
2. For each SendPro Enterprise and HubCapp instance, complete the following:
   1. Navigate to and select the instance site so that it is highlighted in the Sites folder.
   2. In the Actions > Edit Site section of the right panel, select Bindings.
   3. Select the https record shown.
   4. Select Edit.
   5. Select the appropriate certificate from the SSL Certificate menu.
   6. Select OK.
   7. Select Close.
3. Close Internet Information Services (IIS) Manager.

Step 6: Update Workstations

Each computer that needs to access the SendPro Enterprise or HubCapp instances must have the corresponding certificates imported into that computer's Trusted Root Certification Authorities folder. Perform step 2 of these instructions on each affected workstation.