Setting up of TLS for a Sigma device requires three main steps to be addressed; installing OpenSSL, configuring the Sigma through MBTB software, and configuring Jarrison Time. The first step would be done once, the second two as needed per device.
Installation and setup of OpenSSL
OpenSSL is required to be installed and setup on the machine that runs the JT Engine when connecting Sigma devices to Jarrison Time via TLS. The following link can be used to download OpenSSL: Win32/Win64 OpenSSL Installer for Windows

The version that is referenced in this document is Win64 OpenSSL v3.5.0, but the Win32 version can be downloaded and installed if the computer is running a Windows 32-bit version.
After the download is complete, run the .exe or .msi file to start the installation of OpenSSL. The license agreement will need to be accepted on the first page of the installation.

Select ‘Next’ on the location destination, but keep in mind the location where OpenSSL is installed as it will need to be used after the installation has been completed.
Select ‘Next’ on the prompt to create the program’s shortcut.

On the ‘Select Additional Tasks’ install page select ‘The OpenSSL binaries (/bin) directory and select ‘Next’. Select ‘Install’ on the next page and the installation of OpenSSL will proceed.

Once the installation is done, de-select the ‘One-time donation’ (unless you’re feeling generous) and select ‘Finish’.
After the installation is complete, press the ‘Win’ + ‘R’ buttons to open the ‘Run’ window and enter ‘sysdm.cpl’ and select ‘OK’ or press Enter.

The ‘System Properties’ window will open. Select the ‘Advanced’ tab and then the button ‘Environment Variables…’

In the ‘Environment Variables’ windows select ‘New…’ under ‘System variables’

In the ‘Variable name:’ field enter ‘OPENSSL_CONF’. Select ‘Browse File…’ and go to the installation location of OpenSSL-Win64\Bin and select the ‘openssl.config’. Also copy the C:\Program Files\OpenSSL-Win64\bin path because it is going to be used in the next step. Then select ‘OK’


Select the ‘Path’ system variable and select ‘Edit…’

Select ‘New’ and paste the path of the bin folder of OpenSSL and select ‘OK’

Select ‘OK’ on the Environment Variables window and seleck ‘OK’ on the System Properties window. OpenSSL is now successfully installed and setup. To confirm that OpenSSL is working, open Command Prompt and enter ‘openssl version’ and the OpenSSL version will be displayed.

Sigma TLS configuration in MBTB
To configure the TLS communication, the Sigma device will need to have On-demand Security enabled.

Select the Terminal Security icon on the left-hand side of MBTB after connecting to the device.

There are a few things that will need to be done on the Terminal Security page:
Directory Path – Select the ‘Browse’ button to select a folder where the certificates will be saved that will be used in a later step.
Configuration – Keep the configuration on Basic
Validity period – Set the period the created certificates will be valid for.
Password – Enter a password to encrypt the certificates. Please note that this password should be 16 characters long and have at least 3 of the following characters – Uppercase, lowercase, number, symbol.
Select ‘Proceed’ after these settings have been changed accordingly.

The following page will be displayed. Select the ‘Export Certificate for PC’ button.

The following page will be displayed.
Network name of PC – This should be automatically be generated
Validity period – This will be automatically set from the period that was chosen in the previous steps
Export for – Should be set to MACI/MBTB due to MBTB being used to load the certificates
Export Directory – Select the ‘Browse’ button to select a folder where the certificates will be exported to
Select ‘Export’ once done.

The next page will provide the private key password that will need to be saved and stored somewhere for future use. Select ‘OK’ once it has been saved.

Select ‘Generate certificates for terminals’ after exporting the certificates in the previous page.

The next page will then prompt to add the IP address\es of the device\s that will need certificates loaded. Select ‘Generate Certificate’ once the necessary IP addresses have been entered.

The next page will then start to generate the certificates for the devices. Select ‘Load Certificates in Terminals ‘once the certificates have been generated successfully.

On the next page the devices that will have certificates loaded to them will be displayed. Select the ‘Load’ button to start the loading of certificates to the devices.

The next page will then load the certificates to the relevant devices.

Sigma TLS Configuration in Jarrison Time
When connecting a Sigma via TLS to Jarrison Time the following steps will need to be followed to setup the self-assigned certificates or server assigned certificates to allow connection to the Sigma devices via TLS.
In System Configuration go to the Hardware tab. Enable the Use TLS Protocol option.

To create the self-assigned certificates select the Set Certificate Information button. This will display options that will need to be entered to create the self-assigned certificates.
Expiration Date – This will set the date at which the certificate will expire
Email Address – The email address that will be associated with the certificate
Password – The password that will be used to create the certificate and used to connect to the Sigma devices

After the required information has been entered, select the Create Certificates button. A pop-up message will then appear that has the password. The password will need to be saved and entered in Devices when setting up the Sigma device to connect via TLS. Click OK and a message will appear that the certificates were created successfully.

To create the server assigned certificates select the Set Certificate Information as per the previous step and enter the required information – Expiration Date, Email Address and Password. Use CA Certificates will then need to be enabled. Select the Browse buttons to search for and select the Security File and Key File that will be used to create the certificates. Select Create Certificates to create the certificates and the same message to save the password will appear as per the previous steps. Save can then be selected to finish the creation of the certificates.

Then go to Devices, and add the Sigma device with the IP address of the device. Then from the Extra tab enable the Use TLS option.

The Device Password field will then become available and the password created in the previous steps will need to be entered. Once the password has been entered, select the Load Certificates on Device button and the certificates will then be loaded on the device. A pop-up message will be displayed to show if the certificates were loaded successfully.
The port number when connecting via TLS is 11011 and the port will be automatically be changed when the Use TLS option has been enabled. After the certificates have been loaded on the device, Jarrison Time can connect to the device via TLS with normal functionality.
