Use > Hardening > Data Flow Probe Hardening > Create a New Self-Signed Certificate for Two-Way SSL in Agent Driven Inventory Discovery

Create a New Self-Signed Certificate for Two-Way SSL in Agent Driven Inventory Discovery

This task describes how to create a new self-signed certificate for two-way SSL in Agent Driven Inventory Discovery.

Important Make sure you follow the instructions below to replace the hard coded certificates. Otherwise the hard coded certificates would be used.

To do so,

  1. On one of the probes, go to the <DataFlowProbe_Home>\conf\security folder and run the following commands:

    1. Create a private key and a public certificate of UD Agent and store them to the Agent Keystore agent.keystore.

      <DataFlowProbe_Home>\bin\jre\bin\keytool.exe -genkey -alias smartagent -keyalg RSA -sigalg SHA256withRSA -keysize 2048 -keystore agent.keystore -dname "CN=<Common_Name>,OU=<...>,O=<...>,L=<...>,ST=<...>,C=<...>" -storepass logomania
    2. Convert the keystore format to PKCS12.

      <DataFlowProbe_Home>\bin\jre\bin\keytool.exe -importkeystore -srckeystore agent.keystore -destkeystore agentkeystore.p12 -deststoretype PKCS12 -storepass logomania
    3. Extract the private key adikey.pem and the public certificate adicert.pem from the Agent Keystore using OpenSSL.

      openssl pkcs12 -in agentkeystore.p12 -nodes -nocerts -out adikey.pem -passin pass:logomania
      openssl pkcs12 -in agentkeystore.p12 -nodes -nokeys  -out adicert.pem -passin pass:logomania
  2. Import the Agent public certificate adicert.pem you extracted from the first probe to Data Flow Probe Truststore on all probes.

    1. Clean the truststore from the hard coded certificates using this command:

      <DataFlowProbe_Home>\bin\jre\bin\keytool.exe -delete -alias smartagent -keystore ProbeTrustStore.jks -storepass logomania
    2. Import the Agent public certificate adicert.pem to the probe truststore.

      <DataFlowProbe_Home>\bin\jre\bin\keytool.exe -import -v -keystore ProbeTrustStore.jks -file adicert.pem -alias smartagent -storepass logomania
    3. Repeat steps 2a and 2b on all other probes.

  3. Go back to the first probe, create a temporary empty folder, and then create the discoveryResources folder inside it, copy adikey.pem and adicert.pem into the discoveryResources folder, and then create a ZIP package file out of the temporary folder.
  4. Import this package to UCMDB through Administration > Package Manager.
  5. Restart the data flow probe Windows service on all probe servers.
  6. Run the Install UD Agent job to deploy the agent with the new certificates.

    If the agent is already deployed, it needs to be uninstalled (using the Uninstall UD Agent) job first.

    When using the management zone mode, the agents can be uninstalled and installed using the infrastructure discovery activity.

Related information

How to Deploy a Package