Install > Install ITBA > How to Use Your Own Certificate?

How to Use Your Own Certificate?

Every time you log on, a warning about non-trusted certificate is issued with a certificate error. You can use your own certificate. To upload your own certificate to ITBA, perform the steps below on the ITBA server.

Note  

  • The Certificate and the Key should be in PEM format.
  • By default, a self-signed certificate was used during the installation of ITBA. However, it is not recommended to use self-signed certificates in production environments as they may negate the benefits of end-to-end security by decreasing the ability of a user to detect a man-in-the-middle (MITM) attack.
  1. Replace the server certificate and the server private key in the web server.

    1. Obtain the server certificate and the server private key in PEM format. The procedure below refers to them as server.cer.pem and server.key.pem respectively.
    2. Copy the server.cer.pem and server.key.pem to $HPBA_HOME/conf/keys.
    3. Update the web server configuration to use those files.
    4. Edit $HPBA_HOME/webserver/httpd/conf/extra/httpd-ssl.conf.
    5. In httpd-ssl.conf, replace btoa.host.hp.com.key.pem with server.key.pem.
      Replace btoa.host.hp.com.cert.pem with server.cer.pem.
    6. Save changes.
  2. Configure the Java truststore to trust the CA that issued your server certificate.

    1. Obtain the CA certificate in PEM format. The procedure below refers to it as ca.cer.pem.
    2. Copy the ca.cer.pem to $HPBA_HOME/conf/keys.
    3. Import ca.cer.pem into the Java truststore.
    4. Use the CMD to access $HPBA_HOME/jdk/jre/bin.
    5. Execute keytool -import -trustcacerts -alias ca.cer.pem -keystore ../lib/security/cacerts -file $HPBA_HOME/conf/keys/ca.cer.pem.
    6. Enter the keystore password when prompted (default password is changeit).
    7. When prompted whether to trust the certificate, write y.
  3. Restart the ITBA application using the command $HPBA_HOME/supervisor/bin/hpba-restart.sh.sh.