Security and Certificates

Proper configuration of security and certificates is essential for safeguarding sensitive data such as print jobs, user credentials, and administrative access.

General Security

MyQ X uses default security settings for encrypted communication between MyQ components, clients, devices, and external services. The exact TLS behavior depends on the communication layer and configuration, including web HTTPS, SMTP, IPP, LPR, WebSockets, and related settings in config.ini.

Certificates

Certificates are used to secure and validate communication between MyQ servers, print devices, user workstations, mobile clients, and external services. Administrators can manage the server certificates and certificate authority mode used by MyQ so that connecting clients and devices can trust the service. MyQ X supports the use of trusted third-party certificates, as well as internally issued certificates to enable flexible and scalable security configurations for different environments.

Trust Between MyQ X and Servers

To securely connect to external systems that MyQ X needs to interact with, you will need the MyQ server to trust the certificates of these remote servers and services. This is needed for HTTPS, SMTPS, LDAPS, and IPPS.

Since version 10.2, MyQ X is designed to automatically trust the Root CA certificates from the server’s system certificate store.

Certificates in Certificate Management (mmc.exe) > Trusted Root Certificate Authorities are exported into the cacert.pem file that sits in the ProgramData folder of MyQ X.

The certificate synchronization is performed during the Maintenance task run. For this reason, if you encounter problems with certificates, and you confirm that the correct certs are installed in the system, run the Maintenance task, and try connecting MyQ X to the remote system again.

This allows MyQ X to automatically trust certificates issued by imported CAs, which is particularly helpful when they are published by Group Policy or from Active Directory.

Trust Between MyQ X and Connecting Clients

Read how to select the server certificate that MyQ X presents to clients to secure communication.

Before deploying clients or enrolling devices, decide which hostnames or IP addresses they will use to connect to MyQ. Any hostname or IP address used by devices or MyQ Desktop Client must be included in the server certificate’s Subject Alternative Name; otherwise, certificate validation can fail.

You will need this to:

• Serve your users the MyQ Web Interface on HTTPS.

• Communicate securely with printers and MFDs and the Embedded terminals installed on those devices.

• Connect to the server with the Desktop Client operating in the “Strict” mode.

• Print securely via IPPS.

• Connect and print with the Chromebook Extension.

• Connect securely from the Mobile Client for Android and iOS.

You can manage certificates on Print Server and Central Server. Go to MyQ > Settings > Network. The following modes are available:

Built-in Certificate Authority

MyQ creates a self-signed CA certificate and uses it to sign server and client certificates.

To use these certificates in production environments, you need to distribute the CA (which can be exported on the Network page) to all clients that will be connecting to the server. This is feasible for organization-managed devices where this certificate can be distributed with Group Policy or Intune.

To enable BYOD devices to connect, provide users with a way to download and install the MyQ Certificate Authority manually. Otherwise, users may see warnings that the server cannot be trusted.

Embedded terminals also need to trust the certificate presented by the MyQ server; if terminal-side certificate trust is not handled correctly, terminal communication may fail.

Company Certificate Authority

In Company Certificate Authority mode, MyQ uses an intermediate CA certificate from your company CA to sign certificates for the server and clients.

Since this certificate authority (CA) is probably a custom enterprise CA, similar conditions apply as for the built-in self-signed certificate. The CA will need to be distributed to devices that your organization can manage, or made available for end users to install themselves.

Manual Certificate Management

Provide a certificate for the MyQ Server. MyQ creates no certificates; all certificates are managed by you.

This mode is intended for administrators who already understand certificate chains, private keys, Subject Alternative Names (SANs), and trust distribution. In this mode, you provide the server certificate yourself. The certificate must be issued for the MyQ server and signed by a certificate authority that your clients and devices can trust, such as a publicly trusted CA or an internal CA created with Active Directory Certificate Services (AD CS).

Certificates and Embedded Terminals

During remote setup when the Embedded terminals are installed, the MyQ X server uploads the CA certificate to the device, so that when MyQ X presents its certificate to the device, it is trusted. This is, however, possible only in the Built-in Certificate Authority and Company Certificate Authority modes.

In Manual Certificate Management mode, MyQ X does not get access to the CA certificate because it is not provided. Only the server certificate, which is signed by the CA, is uploaded. The CA certificate needs to be added to the devices manually.

Some vendors or devices might have stricter rules for certificate validation, e.g., they can require the certificate to contain the full FQDN (Fully Qualified Domain Name; such as print.acme.com), or the device might reject wildcard certificates (such as *.acme.com).