Step by Step FIPS Migration

Note This step by step FIPS migration process applies to the HTTPS configuration.

After performing the tasks below, you migrate CMS 10.21 (or later) to FIPS mode and you will use the OOTB self-signed certificates, keystores, and truststore files.

If you wish to perform additional customization, see Improving Security.

The step-by-step instructions for switching the CMS 10.21 (or later) system to the FIPS mode consists of the following tasks:

Task 1. Prerequisites

  • Version requirements:

    • UCMDB Server version 10.21 (or later)
    • Configuration Manager version 10.21 (or later)
    • Data Flow Probe version 10.21 (or later)
    • UCMDB Browser version 4.02 (or later)
    • Content Pack version 16.00 (or later)
  • Back up UCMDB database and UCMDB Server installation directory. Before switching the UCMDB Server to FIPS mode, perform a backup of the UCMDB database and the entire UCMDB Server installation directory.

  • Download the correct version of the JCE Unlimited Strength Policy Files for the JRE version you use, because the JCE Unlimited Strength Policy Files are different for each JRE version.

    For example, starting with version 10.30, UCMDB Server uses OpenJDK, the JCE Unlimited Strength Policy Files should be downloaded from Zulu Cryptography Extension Kit provided by OpenJDK.

    Note Configuration Manager (CM) version 10.22 still uses JRE 8, the JCE Unlimited Strength Policy Files should be downloaded from Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 8 Download.

  • Understand that you should strictly follow the sequence in this step-by-step FIPS migration process.

    For example, always switch Configuration Manager and UCMDB Browser to the FIPS mode before you switch the UCMDB server to FIPS mode. Because switching the UCMDB Server to the FIPS mode also updates the LW-SSO configuration, which means that you will not be able to log in to Configuration Manager if it is still in non-FIPS mode.

  • For Data Flow Probes and Integration Service

    • You have deactivated all discovery jobs and integration jobs.

    • If you upgrade probes from version 10.20 to 10.21 (or later) using the upgrade package downloadable from the UCMDB Server, make sure that:

      • All Data Flow Probes are upgraded to version 10.21 (or later), and
      • Content Pack 16.00 (or later) is installed.

Task 2. Configuration Manager Migration - Phase I

Task 3. UCMDB Browser Migration - Phase I

Task 4. UCMDB Server Migration

This task includes the following:

  1. Switch the UCMDB Server to the FIPS mode
  2. Regenerate a new self-signed hpcert and sign it with the default UCMDB root certificate

Task 5. UCMDB UI Migration

Note After switching UCMDB client JRE to FIPS mode, you cannot connect it to a non-FIPS mode UCMDB server!

Task 6. Data Flow Probe Migration

After switching the UCMDB server to the FIPS mode,

  • Data Flow Probes that are upgraded to version 10.21 are switched to the FIPS mode automatically.
  • If you add a new probe to the UCMDB server,

    • If UCMDB server is running in FIPS+HTTP mode (the default mode), the new probe is switched to the FIPS mode automatically.
    • If UCMDB server is running in FIPS+HTTPS mode, edit the ssl.properties file as described below to complete the FIPS migration process for the new probe. This is the scenario that requires manual steps.

Note: Backup copy of the following files are created when Data Flow Probes are switched to FIPS mode:

  • <DataFlowProbe_Home>\conf\DataFlowProbe.properties

  • <DataFlowProbe_Home>\conf\security\ssl.properties

  • <DataFlowProbe_Home>\bin\WrapperGateway.conf

  • <DataFlowProbe_Home>\bin\WrapperManager.conf

The backup copy of these files are saved to the <Probe_Home>\conf\bak directory.

Tip How to check whether a probe or integration service is already switched to FIPS

To check whether a probe or integration service is already in FIPS mode,

  1. Go to the probe or integration service's JMX Console. For example, <Probe_IP>:<Probe_Port>/jmx-console/.
  2. Search for getFipsStatus.
  3. On the result page, check whether the value of the FipsStatus attribute is "Current probe is in FIPS mode".

Task 7. UCMDB Integration Service Migration

To switch UCMDB Integration Service to FIPS mode, do the following,

Tip How to check whether a probe or integration service is already switched to FIPS

To check whether a probe or integration service is already in FIPS mode,

  1. Go to the probe or integration service's JMX Console. For example, <Probe_IP>:<Probe_Port>/jmx-console/.
  2. Search for getFipsStatus.
  3. On the result page, check whether the value of the FipsStatus attribute is "Current probe is in FIPS mode".

Tip If, after you restart the UCMDB Integration Service manually, the FIPS migration process fails and UCMDB Integration Service is not switched to FIPS mode, you can restore the original settings by using the three backup files described in step 3.a, and then repeat step 2 and step 3 to start over the migration process again.

Task 8. Universal Discovery Content Migration

Task 9. Configuration Manager Migration - Phase II

Task 10. UCMDB Browser Migration - Phase II

Task 11. UCMDB Browser Migration - Phase III

Task 12. Configuration Manager Migration - Phase III