Installing the SMT server certificate

By default, the importer binary smt_import validates the SMT server certificate. The remote server certificate is self-signed, therefore there is no CA bundled with SA OSPWopenssl component. To enable access for smt_import to SMT server, you must install the self-signed server certificate in the OSPWopenssl trust store.

To install the SMT server certificate:

1. Download the self-signed certificate from SMT server.
2. Install the self-signed certificate in SA trust store.
3. Verify OPSWopenssl is validating the server certificate.

Downloading the self-signed certificate from SMT server

You can download the certificate from the browser using the URL, http://<smt_host>/smt.crt. You can also download the certificate from /srv/www/htdocs/smt.crt of the SMT server.

Installing the self-signed certificate in SA trust store

1. Open the downloaded file, copy the text appearing at the end of the file.

   The following is an example of the text that appears at the end of the downloaded file:

   -----BEGIN CERTIFICATE-----
   MIIE4TCCA8mgAwIBAgIJANwa5OFPkBHHMA0GCSqGSIb3DQEBCwUAMIGGMQswCQYD
   haXhmbq+5pEkpxGAactW+tORsJmpgTdAXeq2rreYtgZ2/vCwdM0iwSVakGNFAvni
   T9lnSVrADcO/S8V/DzcH30RzSpIS44beE23zag82019fCrsZg9VkYJER4Fn0tRq4
   6U9I4OgBSPSU34MXclGld0BAN+mANWHQYacZ7hHQJtMRP+mc8ZgHIvsKNnKRoHOd
   Rhla7cP7GYrXn/piQAxRW66fOYJOeVIsAWJvgUb+A8ecwb+s6k56cQdLKkm0wKD0
   2zUFMAg=
   -----END CERTIFICATE-----

2. Open the /opt/opsware/openssl/cert.pem file in an editor and paste the copied text at the end of the file.

   The certificate will be installed in the SA trust store. Ensure that openssl tool verifies the SMT server certificate.

   Verifying that OPSWopenssl is validating the server certificate

   After the CA certificate is installed in the SA trust store, verify if openssl validates the SMT server certificate before running the importer:

   /opt/opsware/bin/openssl s_client -connect smt.hostname:443 -verify 3

   If the verification process is successful, the following message will be displayed at the end of the output:

   Verify return code: 0 (ok)

   If the verification fails, a non-zero value will be returned:

   Verify return code: 21 (unable to verify the first certificate)