Use > Hardening > Enabling Secure Sockets Layer (SSL) Communication > Enable SSL on the Server Machine With a Self-Signed Certificate - UCMDB

Enable SSL on the Server Machine With a Self-Signed Certificate - UCMDB

These sections explain how to configure Universal CMDB to support communication using the Secure Sockets Layer (SSL) channel.

  1. Prerequisites

    1. Before starting the following procedure, remove the old server.keystore located in C:\UCMDB\UCMDBServer\conf\security\server.keystore.

    2. Place the Universal CMDB keystore (JKS type) in the C:\UCMDB\UCMDBServer\conf\security folder.

    3. If you want to use a different password for the keystore than the one currently used by the UCMDB server, run the changeKeystorePassword JMX operation, in UCMDB:service=Security Services.

  2. Generate a Server Keystore

    1. Create a keystore (JKS type) with a self-signed certificate and matching private key:

      • From C:\UCMDB\UCMDBServer\bin\jre\bin, run the following command:

        keytool -genkey -alias hpcert -validity 365 -keyalg RSA -keysize 2048 -keystore C:\UCMDB\UCMDBServer\conf\security\server.keystore

        The console dialog box opens.

      • Enter the keystore password.

        Make sure that the password matches the one used by the UCMDB server.

      • Answer the question, What is your first and last name? Enter the Universal CMDB Web server name. Enter the other parameters according to your organization.

      • Enter a key password. The key password MUST be the same as the keystore password.

        A JKS keystore is created named server.keystore with a server certificate named hpcert.

    2. Export the self-signed certificate to a file:

      From C:\UCMDB\UCMDBServer\bin\jre\bin, run the following command:

      keytool -export -alias hpcert -keystore C:\UCMDB\UCMDBServer\conf\security\server.keystore -storepass <your password> -file hpcert.crt
  3. Place the Certificate in the Client’s Trusted Store

    After generating server.keystore and exporting the server certificate, for every client that needs to communicate with Universal CMDB over SSL using this self-signed certificate, place this certificate in the client's trusted stores by running the following command:

    keytool -import -trustcacerts -keystore C:\UCMDB\UCMDBServer\conf\security\server.truststore -storepass <your password> -alias hpcert -file hpcert.crt

    Note There can be only one server certificate in server.keystore.

  4. Disable HTTP Port 8080

    For details, see Enable or Disable HTTP/HTTPS Ports.

    Note Check that HTTPS communication works before closing the HTTP port.

  5. Restart the Server

  6. Display Universal CMDB

    To verify that the UCMDB Server is secure, enter the following URL in the Web browser: https://<UCMDB Server name or IP address>:8443/ucmdb-ui.