Administer > Security Configuration > Communication Configuration > Configuring SSL Communications for Web Access and RMI Communications

Configuring SSL Communications for Web Access and RMI Communications

NNMi includes a suite of default ciphers that are used in configuring Secure Sockets Layer (SSL) in Web access and Java Remote Method Invocation (RMI) communications. The ciphers are listed in the nms-jboss.properties file.

Caution Adding or removing ciphers from the cipher list without the approval of is not supported; doing so may cause damage to the product or cause the product to become inoperable.

Requirement for New NNMi 10.30 Installations

New installations of NNMi support only TLS v1.2 protocol by default. However, to be able to discover and monitor ESXi 5.1 hypervisors, NNMi is required to use the TLSv1 cryptographic protocol.

To configure NNMi to support the TLSv1 cryptographic protocol for device communication:

Note This procedure enables NNMi to use less secure cryptographic protocols that are not FIPS 140-2-certified. This is a global change and may reduce the security of the product.

  1. Log on to the NNMi management server.
  2. Open the following file with a text editor:

    • Windows: %NnmDataDir%\nmsas\NNM\server.properties

    • Linux: /var/opt/OV/nmsas/NNM/server.properties

  3. Update the com.hp.ov.nms.ssl.PROTOCOLS property to include the value TLSv1.

    If the property does not exist, add the following line:

    com.hp.ov.nms.ssl.PROTOCOLS=TLSv1.2,TLSv1.1,TLSv1

  4. Configure NNMi to allow protocols and algorithms that are not FIPS-certified:

    1. On the NNMi management server, go to the following directory:

      • On Windows: %nnminstalldir%\newconfig\HPNmsServStgs\Windows
      • On Linux: /opt/OV/newconfig/HPNmsServStgs/Linux
    2. Copy the java.security file, and then place the copied file in the following directory:

      • On Windows: %nnmdatadir%\conf\nnm
      • On Linux: /var/opt/OV/conf/nnm
  5. Restart the NNMi processes by running the following commands:

    • On Windows:

      1. %nnminstalldir%\bin\ovstop -c
      2. %nnminstalldir%\bin\ovstart -c
    • On Linux:

      1. /opt/OV/bin/ovstop -c
      2. /opt/OV/bin/ovstart -c