Configure an Upgraded NNMi Environment to Use the New Keystore

Prior to the version 10.20, NNMi used to provide a Java KeyStore (JKS) repository to store certificates. NNMi 10.20 introduces a Public Key Cryptography Standards (PKCS) #12 repository to store certificates. The new PKCS #12 file-based certificate management technique is available for use as soon as you install a new instance of NNMi 10.20 on a system.

However, when you upgrade an older version of NNMi (older than 10.20) to the version 10.30, the PKCS #12 file-based certificate management does not immediately come into effect and NNMi continues to use the JKS repository for certificate management.

With additional configuration tasks, you can configure the upgraded NNMi management server to use the new technique of PKCS #12 file-based certificate management.

To configure the upgraded NNMi management server to use PKCS #12 file-based certificate management:

1. Log on to the NNMi management server as root or administrator.

2. Run the following command to migrate to the new keystore file:

   • On Windows:

     %nnminstalldir%\bin\nnmkeytool.ovpl -importkeystore -srckeystore %nnmdatadir%\shared\nnm\certificates\nnm.keystore -destkeystore %nnmdatadir%\shared\nnm\certificates\nnm-key.p12 -srcstoretype JKS -deststoretype PKCS12 -srcprovidername SUN -destprovidername PKCS12 -alias <src_alias>

   • On Linux:

     /opt/OV/bin/nnmkeytool.ovpl -importkeystore -srckeystore /var/opt/OV/shared/nnm/certificates/nnm.keystore -destkeystore /var/opt/OV/shared/nnm/certificates/nnm-key.p12 -srcstoretype JKS -deststoretype PKCS12 -srcprovidername SUN -destprovidername PKCS12 -alias <src_alias>

   The new certificate management technique enables you to retain only a single certificate in the keystore at a time. In this instance, <src_alias> is the alias of the certificate in the old keystore file that you want to migrate.

3. Run the following command to migrate to the new truststore file:

   • On Windows:

     %nnminstalldir%\bin\nnmkeytool.ovpl -importkeystore -srckeystore %nnmdatadir%\shared\nnm\certificates\nnm.truststore -destkeystore %nnmdatadir%\shared\nnm\certificates\nnm-trust.p12 -srcstoretype JKS -deststoretype PKCS12 -srcprovidername SUN -destprovidername PKCS12

   • On Linux:

     /opt/OV/bin/nnmkeytool.ovpl -importkeystore -srckeystore /var/opt/OV/shared/nnm/certificates/nnm.truststore -destkeystore /var/opt/OV/shared/nnm/certificates/nnm-trust.p12 -srcstoretype JKS -deststoretype PKCS12 -srcprovidername SUN -destprovidername PKCS12

4. Open the server.properties file from the following location with a text editor:

   • On Windows:

     %nnmdatadir%\nmsas\nms

   • On Linux:

     /var/opt/OV/nmsas/nms

5. Delete the existing content of the file.

6. Add the following content to the file:

   nnmsas.server.security.keystore.type=PKCS12

   nmsas.server.security.keystore.file=${com.hp.ov.DataDir}/shared/nnm/certificates/nnm-key.p12

   nmsas.server.security.keystore.cred=nnmkeypass

   nmsas.server.security.truststore.file=${com.hp.ov.DataDir}/shared/nnm/certificates/nnm-trust.p12

   nmsas.server.security.truststore.cred=ovpass

   nmsas.server.security.keystore.alias=

   nms.comm.soap.https.PROTOCOLS=TLSv1.2

   Note If you want to discover and monitor virtual networks running on VMware ESXi 5.1 servers, set the nms.comm.soap.https.PROTOCOLS property to TLSv1,TLSv1.1,TLSv1.2.

7. Save the file.

8. Open the nms-local.properties file from the following location with a text editor:

   • On Windows:

     %nnmdatadir%\conf\nnm\props

   • On Linux:

     /var/opt/OV/conf/nnm/props

9. Modify the values of all the javax parameters:

   Parameter	Value
   javax.net.ssl.trustStore	${NnmDataDir}/shared/nnm/certificates/nnm-trust.p12
   javax.net.ssl.trustStoreType	PKCS12
   javax.net.ssl.keyStore	${NnmDataDir}/shared/nnm/certificates/nnm-key.p12
   javax.net.ssl.keyStoreType	PKCS12

10. Save the file.

11. Delete the nnm.keystore and nnm.truststore files from the following directory

    • On Windows:

      %nnmdatadir%\shared\nnm\certificates

    • On Linux:

      /var/opt/OV/shared/nnm/certificates

12. Restart NNMi.