Import the server certificate from HPE CSA to HPE ITOC

This section describes how to import a server certificate from HPE CSA to HPE ITOC for HTTPS communication.

Prerequisites

This process must be performed by a user with privileges to log in to both the HPE CSA and HPE ITOC servers and access the install location.

On the HPE CSA server

1. On the HPE CSA server, verify the certificate is available in the keystore. Use the alias csa to narrow your choices:

   # <csa_server>/csa/openjre/bin/keytool -list -alias csa -v -keystore
<csa_server>/csa/openjre/lib/security/cacerts
Enter keystore password:
Alias name: csa
Creation date: May 27, 2015
Entry type: trustedCertEntry

Owner: CN=csa.server.domain.net, OU=TEST, O=TEST, L=Palo Alto, ST=CA, C=US
Issuer: CN=csa.server.domain.net, OU=TEST, O=TEST, L=Palo Alto, ST=CA, C=US
Serial number: 7a8bdee
Valid from: Wed May 27 02:38:51 PDT 2015 until: Thu Sep 24 02:38:51 PDT 2015
Certificate fingerprints:
MD5: 1E:35:CB:E0:B6:93:B9:21:8C:17:BF:57:C5:61:B0:70
SHA1: 85:54:F8:E8:A3:D5:6C:7B:5A:5D:AF:AA:14:A9:03:E3:67:F9:2A:39
SHA256: 9B:AB:E7:77:4F:84:C7:54:D2:7D:F0:4B:2F:EE:37:30:56:1F:66:72:
A9:30:43:62:22:AF:7A:49:80:D1:94:5A
Signature algorithm name: SHA256withRSA
Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 40 41 77 C8 53 D2 F7 CB 6B 42 66 9F D7 3F 25 AA @Aw.S...kBf..?%.
0010: 9E 43 09 30 .C.0
]
]
#

2. Export the certificate to a file, using the default Java keystore password changeit when prompted.
   # <csa_server>/csa/openjre/bin/keytool -export -alias csa -file /tmp/csa.crt -keystore
<csa_server>/csa/openjre/lib/security/cacerts
Enter keystore password:
Certificate stored in file </tmp/csa.crt>
#
3. On the HPE ITOC server, copy the exported certificate file csa.crt from the HPE CSA server to the HPE ITOC server and import the certificate.
   • Use the default Java keystore password changeit when prompted.
   • Enter yes when prompted: Trust this certificate?

# <itoc_server>/openjre/bin/keytool -importcert -alias csa -file /tmp/csa.crt -keystore <itoc_server>/wildfly-8.1.0.Final/standalone/configuration/selfcacerts
Enter keystore password:
Owner: CN=csa.server.domain.net, OU=TEST, O=TEST, L=Palo Alto, ST=CA, C=US
Issuer: CN=csa.server.domain.net, OU=TEST, O=TEST, L=Palo Alto, ST=CA, C=US
Serial number: 7a8bdee
Valid from: Wed May 27 02:38:51 PDT 2015 until: Thu Sep 24 02:38:51 PDT 2015
Certificate fingerprints:
MD5:
1E:35:CB:E0:B6:93:B9:21:8C:17:BF:57:C5:61:B0:70
SHA1: 85:54:F8:E8:A3:D5:6C:7B:5A:5D:AF:AA:14:A9:03:E3:67:F9:2A:39
SHA256: 9B:AB:E7:77:4F:84:C7:54:D2:7D:F0:4B:2F:EE:37:30:56:1F:
66:72:A9:30:43:62:22:AF:7A:49:80:D1:94:5A
Signature algorithm name: SHA256withRSA
Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 40 41 77 C8 53 D2 F7 CB 6B 42 66 9F D7 3F 25
AA @Aw.S...kBf..?%.
0010: 9E 43 09 30 .C.0
]
]
Trust this certificate? [no]: yes
Certificate was added to keystore
#

List the certificate to confirm

# <itoc_server>/openjre/bin/keytool -list -alias csa -v -keystore /opt/hp/itoc/wildfly-8.1.0.Final/standalone/configuration/selfcacerts
Enter keystore password:
Alias name: csa
Creation date: Jul 28, 2015
Entry type: trustedCertEntry
Owner: CN=csa.server.domain.net, OU=TEST, O=TEST, L=Palo Alto, ST=CA, C=US
Issuer: CN=csa.server.domain.net, OU=TEST, O=TEST, L=Palo Alto, ST=CA, C=US
Serial number: 7a8bdee
Valid from: Wed May 27 02:38:51 PDT 2015 until: Thu Sep 24 02:38:51 PDT 2015
Certificate fingerprints:
MD5: 1E:35:CB:E0:B6:93:B9:21:8C:17:BF:57:C5:61:B0:70
SHA1: 85:54:F8:E8:A3:D5:6C:7B:5A:5D:AF:AA:14:A9:03:E3:67:F9:2A:39
SHA256: 9B:AB:E7:77:4F:84:C7:54:D2:7D:F0:4B:2F:EE:37:30:56:
1F:66:72:A9:30:43:62:22:AF:7A:49:80:D1:94:5A
Signature algorithm name: SHA256withRSA
Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 40 41 77 C8 53 D2 F7 CB 6B 42 66 9F D7 3F 25 AA @Aw.S...kBf..?%.
0010: 9E 43 09 30 .C.0
]
]
#

4. Restart the HPE ITOC server.