Improving Security

In case you do not want to use the OOTB certificates from UCMDB, you can generate or use your own FIPS keystores (probe, UI, UCMDB Browser, and so on).

When manipulating FIPS certificates and keystores (when executing keytool commands) you should use the provider from RSA BSAFE Crypto-J Toolkit (JsafeJCE). In addition, consider the fact that the certificate stores in FIPS mode are of type PKCS12.

The keytool commands from Generate a Standalone Self-Signed Certificate (hpcert) Using JsafeJCE Cryptography Provider and from Generate a Self-Signed Root Certificate (hproot) and a Self-Signed Certificate (hpcert) Which Will Be Signed by hproot Using JsafeJCE Cryptography Provider can be taken as examples on how to manipulate FIPS certificates and keystores. You can also modify them in case you use your own certificates signed by a specific Certificate Authority. For the sake of the example we have used here self signed certificates but the commands are similar when using custom certificates.

This chapter describes how to: