@Jal_963,
In principle:
- you can generate CSRs from the Active Node in HA, Passive Node in HA, or from both - does not matter because they are synced, just have to time and queue the Commits right;
- you can generate CSRs using external tool, I like working with XCA (https://hohnstaedt.de/xca/), and import them into PA after signing;
- you can specify Common Name and Subject Alternative Name to whatever you want, however using the hostname/FQDN makes most sense most of the time as those correspond to the WebUI URL; best practice is to have both Common Name and Subject Alternative Name with equal values;
- you possibly could use one certificate for WebUI of both HA nodes, however it would require some trickery;
- Certificates and SSL/TLS Service Profiles are synced in HA as long as they are not used for WebUI.
More to the point, workflow could be:
- Login into Active Node;
- prepare two CSRs with CN/SAN corresponding to the WebUI URLs on Active Node;
- import signed by external CA certificates into Active Node;
- Commit on Active Node;
- create two SSL/TLS Service Profiles, one for each certificate;
- use one of the SSL/TLS Service Profiles as WebUI SSL/TLS Service Profile on Active Node;
- Commit on Active Node;
- Login into Passive Node;
- use one of the SSL/TLS Service Profiles as WebUI SSL/TLS Service Profile on Passive Node;
- Commit on Passive Node;
It is possible to perform it a bit quicker, but longer way is simpler.
