PEC-REC/Current/Administrator/EncryptingRecordings - Revision history

Santhosh Annamalai: Published

2025-03-28T09:04:32Z

Published

Brian.marshall@genesys.com: Published

2021-04-19T17:49:32Z

Published

Bmarshall: Published

2020-10-05T15:49:21Z

Published

WikiSysop: Text replacement - "\|Platform=([^\|])GenesysEngage-onpremises([\|])" to "|Platform=$1GenesysEngage-cloud$2"

2020-07-25T02:31:38Z

Text replacement - "\|Platform=([^\|]*)GenesysEngage-onpremises([\|]*)" to "|Platform=$1GenesysEngage-cloud$2"

WikiSysop: Text replacement - "\|Platforms?=([^\|])PureEngage([\|])" to "|Platform=$1GenesysEngage-onpremises$2"

2020-07-15T11:46:02Z

Text replacement - "\|Platforms?=([^\|]*)PureEngage([\|]*)" to "|Platform=$1GenesysEngage-onpremises$2"

Bgrenon: Published

2020-06-08T15:20:45Z

Published

New page

{{Article
|Standalone=No
|DisplayName=Recording certificate management
|TocName=Recording certificate management
|Context=The Genesys recording solution requires proper management of public and private keys used to encrypt voice and screen recordings. This page describes the process for generating and installing the public and private keys.
|ComingSoon=No
|Platform=PureEngage
|Role=Administrator
|Application=Recording
|Prereq=
|Section={{Section
|sectionHeading=
|anchor=
|alignment=Vertical
|Media=
|image=
|structuredtext=The Genesys recording solution requires proper management of public and private keys used to encrypt voice and screen recordings. The public key is stored in a certificate file and is used to encrypt a unique session key that is then used to encrypt each media file. The public key must be provisioned for voice recordings and for screen recordings. The private key is stored securely on a protected server and is used to help decrypt each media file (voice or screen) for playback.{{NoteFormat|It is your responsibility to store your private keys and certificates, including the expired ones. Genesys will not be able to re-apply any of your keys or certificates in the event of a catastrophic Genesys site failure. In this case, you will need to re-apply any previously created keys. Therefore, these keys must be kept somewhere safe and reliable for future use. Furthermore, if you will be taking advantage of the Recording Cloud Backup Service utility, then, in order to listen to those recordings once they have been moved to your own site, you will need to have the keys and certificates available. Please contact your Genesys Professional if you have any questions about this very important note.}}
|structuredtextwide=
|FAQHeading=
|Status=No
}}{{Section
|sectionHeading=Certificate requirements
|anchor=
|alignment=Vertical
|Media=
|image=
|structuredtext=Before you can encrypt certificates for voice and screen recordings, you must generate the following keys and certificates:

*A recording private key in <tt>.pem</tt> format.<br />2048-bit RSA (or higher). Align encryption strength requirements with your IT Security.
*Self-Signed Recording certificate (also known as public key) in <tt>.pem X.509 RSA</tt> format.The certificate validity period will determine when the next certificate should be generated for renewal.
*:'''Note:''' It is the customer's responsibility to track this, install a new key and certificate prior to expiry and contact Genesys to help provision the new key and certificate before the expiration date.

===Generating a self-signed certificate key pair using OpenSSL===
{{NoteFormat|To generate a self-signed certificate key pair using OpenSSL you must have access to a Linux/Windows system with OpenSSL installed.}}

The following OpenSSL command to generate the certificate signing request and private key is an example:

<source lang="text" enclose="div">
openssl genrsa -out tenant.key 2048
openssl req -new -x509 -key tenant.key -out tenant.pem -days validity_period -subj "/CN=common_name/C=Country/ST=State/O=Organization"
</source>

'''Example:'''

:<source lang="text" enclose="div">
openssl genrsa -out tenant.key 2048
openssl req -new -x509 -key tenant.key -out tenant.pem -days 3650 -subj "/CN=Genesys Recording/C=US/ST=California/O=Genesys"
</source>

Refer to the following table for DN field descriptions and sample values:

{{{!}} class="wikitable"
{{!}}-
!{{!}}'''DN Field'''
!{{!}}'''Description'''
!{{!}}'''Example'''
{{!}}-
{{!}}{{!}}Common Name (CN)
{{!}}{{!}}The name of your recording solution.
{{!}}{{!}}Genesys Recording
{{!}}-
{{!}}{{!}}Country (C)
{{!}}{{!}}A two-letter country code.
{{!}}{{!}}US
{{!}}-
{{!}}{{!}}State or Province (ST)
{{!}}{{!}}The full state or province where your organization is legally located.
{{!}}{{!}}California
{{!}}-
{{!}}{{!}}Organization (O)
{{!}}{{!}}The exact legal name of your organization. Do not abbreviate your organization name.
{{!}}{{!}}Genesys
{{!}}}

As a result of this command, the following two files are created:

*tenant.key—the private key (PEM format) that is used to decrypt the recordings. It must be kept safe and should not be shared.
*tenant.pem—a self-signed recording certificate and the public key.
|structuredtextwide=
|FAQHeading=
|Status=No
}}{{Section
|sectionHeading=Uploading/installing certificates to encrypt your voice recordings
|anchor=upload
|alignment=Vertical
|Media=
|image=
|structuredtext={{NoteFormat|The following steps describe how to configure encryption for voice recordings and should be performed by an administrator.}}
===Upload recording certificates===

#Verify that you have Administrator privileges.{{NoteFormat|The Platform Administration section of the Genesys Portal is the tool that should be used to manage recording certificates (public keys), and private keys.|}}
#Select '''Administration > Certificates'''.
#:The '''Recording Certificates''' screen displays the list of defined Recording Certificates. To refresh the list at any time, click [[file:Gir_refresh.png]].
#:[[file:Gir_certlist.png|500px]]
#:{{NoteFormat|Click a recording certificate in the list to display its details.|2}}
#Click '''Upload'''.
#:[[file:Voice_upload2.png|500px]]
#In the '''Upload Certificate''' panel, under '''Certificate File''', click '''Choose File'''.
#Select the recording certificate file (PEM file).
#:The '''Subject Name''', '''Serial Number''', '''Subject DN''', and '''Issuer DN''' fields automatically populate.
#In the '''Key File''' section, click '''Choose File'''.
#Select the private key file.
#:[[file:certificate_upload_gir.png|500px]]
#Leave the '''Private Key Password''' field empty.
#Click '''Save'''. Both public and private keys are stored in a secure keystore file dedicated to your tenant.
#After uploading the self-signed recording certificate you must contact your Genesys Professional and ask them to have the certificate assigned to your IVR profile. You will be asked for a copy of the Self-Signed Recording Certificate. You do not need to provide them your private key.

{{NoteFormat|
* If you upload and/or delete recording certificates in one Platform Administration session, these changes are not reflected in another Platform Administration session. You must log out and log in again to the second Platform Administration session.
* In the Certificate Administration section, there is an option to Delete certificates. Do not delete any certificates without first discussing this with your Genesys Professional, since there may be adverse side-effects of doing this (for example, not being able to playback recordings). Even if a certificate is expired, it will need to remain in the system so that older recordings can be played back.}}
|structuredtextwide=
|FAQHeading=
|Status=No
}}{{Section
|sectionHeading=Provisioning certificates for screen recording
|anchor=ProvisioningCertificates
|alignment=Vertical
|Media=
|image=
|structuredtext=Perform the following steps to configure encryption for screen recordings, only after completing the {{Link-SomewhereInThisManual|topic=EncryptingRecordings|anchor=upload|display text=Uploading/installing certificates to encrypt your voice recordings}} procedure. If you have not purchased screen recording services, you may skip this step.
===Screen Recording Certificates list===
The Screen Recording Certificates page enables you to manage the certificates for screen recording encryption.

*Assign new certificates
*Remove certificates

[[file:Screenrecording_certificate.png|500px]]
|structuredtextwide=
|FAQHeading=
|Status=No
}}{{Section
|sectionHeading=Assigning Screen Recording Certificates
|anchor=AssigningCertificates
|alignment=Vertical
|Media=
|image=
|structuredtext=To assign a new certificate:

#In the header, go to '''Administration > Screen Recording Certificates'''.
#On the '''Screen Recording Certificates''' panel, click '''Add'''.
#From the '''Select Certificate''' window, perform one of the following actions:
#*Select the check box next to the appropriate certificate, and click '''Add'''.
#*Click '''Cancel''' to discard any changes.
#*Perform one of the following actions:
#*Click the '''Save''' button to accept the changes.
#*Click the '''Cancel''' button to discard the changes.
|structuredtextwide=
|FAQHeading=
|Status=No
}}{{Section
|sectionHeading=Removing Screen Recording Certificates
|anchor=RemovingCertificates
|alignment=Vertical
|Media=
|image=
|structuredtext=To remove a Recording Certificate, perform the following actions:

#In the header, go to '''Administration > Screen Recording Certificates'''.
#On the '''Screen Recording Certificates''' panel, select the check box next to the certificate that you want to remove.
#Click '''Remove'''.
#Perform one of the following actions:
#*Click the '''Save''' button to accept the changes.
#*Click the '''Cancel''' button to discard the changes.

{{NoteFormat|
*If you remove a certificate from the Screen Recording Certificates, you will turn off encryption, and screen recordings will no longer be encrypted. Do not remove any certificates without first discussing this with your Genesys Professional.
*The modifications to encryption settings described in this document only affect future recordings and do not change the encrypted status of old recordings.}}
|structuredtextwide=
|FAQHeading=
|Status=No
}}
}}

@@ Line 10: / Line 10: @@
 |Section={{Section
 |alignment=Vertical
-|structuredtext=The Genesys recording solution requires proper management of public and private keys used to encrypt voice and screen recordings. The public key is stored in a certificate file and is used to encrypt a unique session key that is then used to encrypt each media file. The public key must be provisioned for voice recordings and for screen recordings. The private key is stored securely on a protected server and is used to help decrypt each media file (voice or screen) for playback.{{NoteFormat|It is your responsibility to store your private keys and certificates, including the expired ones. Genesys will not be able to re-apply any of your keys or certificates in the event of a catastrophic Genesys site failure. In this case, you will need to re-apply any previously created keys. Therefore, these keys must be kept somewhere safe and reliable for future use. Furthermore, if you will be taking advantage of the Recording Cloud Backup Service utility, then, in order to listen to those recordings once they have been moved to your own site, you will need to have the keys and certificates available.  Please contact your Genesys Professional if you have any questions about this very important note.}}
+|structuredtext=The Genesys recording solution requires proper management of public and private keys used to encrypt voice and screen recordings. The public key is stored in a certificate file and is used to encrypt a unique session key that is then used to encrypt each media file. The public key must be provisioned for voice recordings and for screen recordings. The private key is stored securely on a protected server and is used to help decrypt each media file (voice or screen) for playback.
 |Status=No
 }}{{Section
@@ Line 33: / Line 40: @@
 </source>
+====Example:====
 :<source lang="text" enclose="div">
@@ Line 44: / Line 49: @@
 Refer to the following table for DN field descriptions and sample values:
 {{{!}} class="wikitable"
 {{!}}-
@@ Line 74: / Line 77: @@
 *tenant.key—the private key (PEM format) that is used to decrypt the recordings. It must be kept safe and should not be shared.
 *tenant.pem—a self-signed recording certificate and the public key.
 |Status=No
 }}{{Section
@@ Line 79: / Line 95: @@
 |anchor=upload
 |alignment=Vertical
-|structuredtext={{NoteFormat|The following steps describe how to configure encryption for voice recordings and should be performed by an administrator.}}
+|structuredtext=Depending on your cloud hosting platform, follow the steps described in {{Link-SomewhereInThisVersion|manual=Administrator|topic=EncryptingRecordings|anchor=certAWS|display text=Upload recording certificates (AWS)}} or {{Link-SomewhereInThisVersion|manual=Administrator|topic=EncryptingRecordings|anchor=certAzure|display text=Upload recording certificates (Azure)}}.
-===Upload recording certificates===
+{{AnchorDiv|certAWS}}
 #Verify that you have Administrator privileges.{{NoteFormat|The Platform Administration section of the Genesys Portal is the tool that should be used to manage recording certificates (public keys), and private keys.|}}
@@ Line 102: / Line 120: @@
 * If you upload and/or delete recording certificates in one Platform Administration session, these changes are not reflected in another Platform Administration session. You must log out and log in again to the second Platform Administration session.
 * In the Certificate Administration section, there is an option to Delete certificates. Do not delete any certificates without first discussing this with your Genesys Professional, since there may be adverse side-effects of doing this (for example, not being able to playback recordings). Even if a certificate is expired, it will need to remain in the system so that older recordings can be played back.}}
 |Status=No
 }}{{Section
@@ Line 111: / Line 138: @@
 The Screen Recording Certificates page enables you to manage the certificates for screen recording encryption.
-*Assign new certificates
+*{{Link-SomewhereInThisVersion|manual=Administrator|topic=EncryptingRecordings|anchor=AssigningCertificates|display text=Assign new certificates}}
-*Remove certificates
+*{{Link-SomewhereInThisVersion|manual=Administrator|topic=EncryptingRecordings|anchor=RemovingCertificates|display text=Remove certificates}}
 [[file:Screenrecording_certificate.png|500px]]
-|Status=No
-}}{{Section
+{{AnchorDiv|AssigningCertificates}}
-|sectionHeading=Assigning Screen Recording Certificates
+===Assigning Screen Recording Certificates===
-|anchor=AssigningCertificates
-|alignment=Vertical
+To assign a new certificate:
 #In the header, go to '''Administration > Screen Recording Certificates'''.
@@ Line 130: / Line 156: @@
 #*Click the '''Save''' button to accept the changes.
 #*Click the '''Cancel''' button to discard the changes.
-|Status=No
-}}{{Section
+{{AnchorDiv|RemovingCertificates}}
-|sectionHeading=Removing Screen Recording Certificates
+===Removing Screen Recording Certificates===
-|anchor=RemovingCertificates
+To remove a Recording Certificate, perform the following actions:
 #In the header, go to '''Administration > Screen Recording Certificates'''.

@@ Line 14: / Line 14: @@
 }}{{Section
 |sectionHeading=Certificate requirements
 |alignment=Vertical
 |structuredtext=Before you can encrypt certificates for voice and screen recordings, you must generate the following keys and certificates:
 *Generate a recording private key in <tt>.pem</tt> format.<br />2048-bit RSA (or higher). Align encryption strength requirements with your IT Security.
-*Generate a self-signed recording certificate (also known as a public key) in <tt>.pem X.509 RSA</tt> format.The certificate validity period will determine when the next certificate should be generated for renewal.
+*Generate a self-signed recording certificate (also known as a public key) in <tt>.pem X.509 RSA</tt> format. The certificate validity period will determine when the next certificate should be generated for renewal.
 *:'''Note:''' It is the customer's responsibility to track this, install a new key and certificate prior to expiry and contact Genesys to help provision the new key and certificate before the expiration date.

@@ Line 5: / Line 5: @@
 |Context=The Genesys recording solution requires proper management of public and private keys used to encrypt voice and screen recordings. This page describes the process for generating and installing the public and private keys.
 |ComingSoon=No
-|Platform=GenesysEngage-onpremises
+|Platform=GenesysEngage-cloud
 |Role=Administrator
 |Application=Recording

PEC-REC/Current/Administrator/EncryptingRecordings - Revision history

Santhosh Annamalai: Published

Brian.marshall@genesys.com: Published

Bmarshall: Published

WikiSysop: Text replacement - "\|Platform=([^\|]*)GenesysEngage-onpremises([\|]*)" to "|Platform=$1GenesysEngage-cloud$2"

WikiSysop: Text replacement - "\|Platforms?=([^\|]*)PureEngage([\|]*)" to "|Platform=$1GenesysEngage-onpremises$2"

Bgrenon: Published

WikiSysop: Text replacement - "\|Platform=([^\|])GenesysEngage-onpremises([\|])" to "|Platform=$1GenesysEngage-cloud$2"

WikiSysop: Text replacement - "\|Platforms?=([^\|])PureEngage([\|])" to "|Platform=$1GenesysEngage-onpremises$2"