Install TLS Certificates on Windows (Optional)

TLS certificates are optional during NCache installation but are required when TLS encryption is enabled for client-server, server-server, or Bridge communication.

Before configuring TLS in NCache, install the required identity and Certificate Authority (CA) certificates on every participating Windows machine.

Important

Stop all caches and client applications before installing or replacing TLS certificates. And you can learn more about certificate placement in the Planning section.

Step 1: Obtain a TLS Certificate

Obtain a certificate issued by a trusted public or private Certificate Authority. The certificate must include an exportable private key.

Self-signed certificates can be used for development and testing but are not recommended for production environments.

When using a test certificate that contains both the identity certificate and its CA chain, import the required certificate into both the Personal and Trusted Root stores.

If the certificates are provided separately:

  • Import the identity certificate into the Personal store.
  • Import the issuing root CA certificate into the Trusted Root Certification Authorities store.
  • Import any required intermediate certificates into the appropriate intermediate certificate store.

Step 2: Open the Certificate Manager

To manage the Windows certificate stores:

  1. Press Windows+R.
  2. Enter mmc and press Enter.
  3. From the File menu, select Add/Remove Snap-in.
  4. Select Certificates and click Add.
  5. Choose the account under which the certificate will be available.

Step 3: Import the Certificates

Import the identity certificate and its private key into:

Certificates > Personal > Certificates

Import the issuing CA certificate into:

Certificates > Trusted Root Certification Authorities > Certificates

Ensure that the certificate appears under the account used by the NCache Service or client application.

Step 4: Grant Private-Key Access

The account running the NCache Service must be able to read the private key of the identity certificate.

To grant access:

  1. Open the Personal > Certificates store.
  2. Right-click the identity certificate.
  3. Select All Tasks > Manage Private Keys.
  4. Add the account used to run the NCache Service.
  5. Grant the account Read permission.

For mutual TLS, the account running the client application must also have access to the private key of the client identity certificate.

Important

TLS initialization can fail when the NCache Service or client application cannot access the certificate's private key.

Step 5: Record the Certificate Details

NCache identifies the configured certificate through its Common Name and thumbprint.

To obtain these values:

  1. Double-click the certificate in the Personal store.
  2. Open the Details tab.
  3. Select Thumbprint and copy its value.
  4. Remove any spaces or colon characters from the copied thumbprint.
  5. Select Subject and record the value following CN=.

Keep the certificate Common Name and thumbprint available when enabling TLS in NCache.

Verify the Certificate Setup

Before enabling TLS, verify that:

  • The identity certificate contains its private key.
  • The certificate is installed under the correct machine or user account.
  • The NCache Service account has Read access to the private key.
  • The required root and intermediate CA certificates are trusted.
  • The certificate is valid and has not expired.
  • The certificate Common Name and thumbprint have been recorded correctly.
  • The required certificates are installed on all participating clients, cache servers, and Bridge nodes.

After installing the certificates, configure the required TLS communication settings and restart the NCache Service, caches, and client applications.

Note

You can learn more about using TLS with NCache in the Administrator's Guide.

See Also

TLS Certificate Placement
Configure TLS
Configure Security