Administer > Setup and Maintenance > Connected Servers > Establish a trust relationship for a server connection

Establish a trust relationship for a server connection

For connection and communication between OMi and OM hosts or other OMi hosts, you must establish a trust relationship between the systems.

In OM server pooling, the virtual server must have a certificate that is trusted by all OM hosts in the server pool and by all OMi hosts.

Note The trust relationship must be set up on all nodes (data processing servers, gateway servers, manager-of-manager configurations, load balancers, and reverse proxies). However, some load balancer technologies include a by-pass or pass-through functionality for incoming encrypted messages to its pool members. When using such technologies, the trust relationship on the load balancer node is not required if you are load balancing on the recommended OSI layer 2 or 4.

ClosedHow to establish a trust relationship between the data processing servers and external server systems)

  1. On the OMi data processing server, execute the following command:

    BBCTrustServer[.bat|sh] <external_server>

    Replace <external_server> with the FQDN of the external system (for example, ommgmtsv).

    Note The value of <external_server> should be the virtual name if the OM server is part of a server pool or runs in a high-availability (HA) cluster.

    When asked if to add a certificate to the trust store, enter y.

    If the trusted certificate already exists, the tool asks you if you want to overwrite the existing certificate. To replace the existing certificate with a new one, enter y.

  2. OM servers only:

    Note If you have the appropriate OM patch or version, you can skip this step.

    • OM for Windows: Starting with patches OMW_00121 (32-bit) and OMW_00122 (64-bit), the BBCTrustServer tool is already installed in the %OvInstallDir%\contrib\OVOW folder.
    • OM for UNIX or Linux: Starting with OM server version 9.10.220, the BBCTrustServer tool is already installed in the /opt/OV/bin directory.

    1. Locate the following files on the OMi data processing server:

      <OMi_HOME>/opr/lib/cli/opr-cli.jar  
      <OMi_HOME>/opr/bin/BBCTrustServer.bat  
      <OMi_HOME>/opr/bin/BBCTrustServer.sh

    2. OM for Windows only: Copy the files to the machine that is running the OM for Windows management server.

      Copy opr-cli.jar to %OvInstallDir%\java\opr-cli.jar.

      Copy BBCTrustServer.bat to %OvBinDir%\BBCTrustServer.bat.

    3. OM for UNIX and Linux only: Copy the files to the machine that is running the OM for UNIX or Linux management server.

      Copy opr-cli.jar to /opt/OV/java/opr-cli.jar.

      Copy BBCTrustServer.sh to /opt/OV/bin/BBCTrustServer.sh.

      Change the permissions of the BBCTrustServer tool by entering the following command:

      chmod 555 /opt/OV/bin/BBCTrustServer.sh

  3. If you do not have a load balancer or a reverse proxy, or your load balancer is configured to work on OSI layers 2 or 4 (recommended by HPE), execute the following command on the external system:

    BBCTrustServer.[bat|sh] <load_balancer_or_single_gateway_server_or_RP_or_Server_Pool_Virtual_Interface>

    When asked if to add a certificate to the trust store, enter y.

    If the trusted certificate already exists, the tool asks you if you want to overwrite the existing certificate. To replace the existing certificate with a new one, enter y.

  4. If you are using a reverse proxy or your load balancer is configured to work on OSI layer 7, you must exchange the certificates manually:

    1. On the OMi data processing server, execute the following command: 

      ovcert -exporttrusted -file <omi.cer>

    2. On the external system, execute the following command:

      ovcert -exporttrusted -file <other.cer>

    3. Copy <other.cer> from the external system to the OMi data processing server.

    4. Copy <omi.cer> from the OMi data processing server to the external system.

    5. On the OMi data processing server, execute the following commands: 

      ovcert -importtrusted -file <other.cer>  
      ovcert -importtrusted -file <other.cer> -ovrg server

    6. On the external system, execute the following commands: 

      ovcert -importtrusted -file <omi.cer>  
      ovcert -importtrusted -file <omi.cer> -ovrg server

  5. If you are using a load balancer or a reverse proxy, where your data sources are not communicating directly with the OMi gateway servers, make sure that port 383 is routed through the load balancer to the OMi gateway servers.

    If the load balancer or the reverse proxy is configured to pass through traffic directly (OSI layers 2 or 4), skip to the next step. If configured to work on OSI layer 7, perform as follows:

    • The certificate on the load balancer must be installed for port 383 (or the port that you configured for secure communication).

    • Communication between the load balancer and the gateway server systems must be secured.

    • The load balancer must possess a server certificate for authentication so that the external systems can connect successfully. The load balancer must also validate client certificates presented by external clients (for example, OM servers).

    • The load balancer must possess a client certificate for authentication with OMi.

    1. Issue a certificate for the load balancer from the OMi data processing server:

      ovcm -issue -file <certificate file> -name <Fully Qualified Domain Name of Virtual Interface or Reverse Proxy> [ -pass <passphrase>]

    2. Import this certificate as a server and client certificate into your load balancer.

      For details on the required format, see your load balancer documentation. You can use openssl to convert the certificates into the required format.

  6. Check the connection between the servers. For details, see Verify the trusted relationship.

Send Help Center feedback