Develop > Command-Line Interfaces > opr-internal-tls-config Command-Line Interface

opr-internal-tls-config Command-Line Interface

OMi enables TLS for internal communication by default. However, in case TLS needs to be disabled for troubleshooting purposes, you can use the opr-internal-tls-config command-line interface (CLI). This CLI allows you to temporarily disable and then enable secure internal communication, check its status, and regenerate keys and certificates if the keystore is compromised or corrupted.

Note In a distributed environment, options for opr-internal-tls-config that change the status of the system can only be called in the data processing server. Options that check status or validity, without changing the status, can be called from either the gateway or data processing server. See the descriptions of the options below for more information.

Location

<OMi_HOME>/bin/opr-internal-tls-config.[bat|sh]

Synopsis

opr-internal-tls-config -help | -check | -activate | -deactivate | -regenerate | -validate

Options

Option Description
-help|-h Displays a summary of the command options. In a distributed environment, can be run from either the gateway or data processing server.
-check|-c Checks the status of secure internal communication and related ports. In a distributed environment, can be run from either the gateway or data processing server.
-activate|-a

Enables secure internal communication. In a distributed environment, can only be run from the data processing server.

-deactivate|-d

Disables secure internal communication. In a distributed environment, can only be run from the data processing server.

-regenerate|-r

Regenerates keys and certificates used for secure internal communication. In a distributed environment, can only be run from the data processing server.

-validate|-va Checks the validity of internal certificates. In a distributed environment, can be run from either the gateway or data processing server.

Caution Make sure to use the -activate, -deactivate, or -regenerate option with the opr-internal-tls-config CLI only when OMi is stopped. After running any of these commands, you must restart all OMi servers.

Exit Status

Exit Status

Description

Output
0

Successful completion of the requested operation.

 No output.
1

Failure of the requested operation.

 An error message stating why the operation failed, followed by the tool's help text.
2 Failure of the requested operation due to invalid argument on the command line. An error message stating why the operation failed, followed by the tool's help text.

Restrictions

To run opr-internal-tls-config, the same permissions as for the user installing OMi are required:

  • Windows: administrative privileges

  • Linux: root user

Example

  • Change the key length:

    Note: Keys that are generated automatically for the internal credentials are 2048 bits. You can use a longer key length by following these steps, but make sure that you keep the content of the key length file in sync on all nodes of your OMi deployment.

    Stop OMi. Edit the file <OMi_Home>/conf/internal-tls.properties. Run opr-internal-tls-config -regenerate to regenerate the keys and the certificate in the database. Restart OMi.

Send Help Center feedback