Enable SSL on the Server Machine with a Self-Signed Certificate - Configuration Manager

This section explains how to configure Configuration Manager to support authentication and encryption using the Secure Sockets Layer (SSL) channel.

Configuration Manager uses Tomcat 7.0.19 as the application server.

1. Prerequisites (not relevant if installing for the first time)

   Before starting the following procedure, remove the old tomcat.keystore file located in the <Configuration_Manager_installation_directory>\java\windows\x86_64\lib\security\ folder or the <Configuration_Manager_installation_directory>\java\linux\x86_64\lib\security\ folder (whichever is relevant), if it exists.

2. Generate a Server Keystore

   Create a keystore (JKS type) with a self-signed certificate and matching private key:

   • From <Configuration_Manager_installation_directory>\java\windows\x86_64\bin or <Configuration_Manager_installation_directory>\java\linux\x86_64\bin, run the following command:

     keytool -genkey -alias tomcat -keyalg RSA -keystore ..\lib\
     security\tomcat.keystore
     

     The console dialog box opens.

   • Enter the keystore password. If the password has changed, change it manually in the file.

   • Answer the question, What is your first and last name? Enter the Configuration Manager Web server name. Enter the other parameters according to your organization.

   • Enter a key password. The key password MUST be the same as the keystore password.

     A JKS keystore is created named tomcat.keystore with a server certificate named hpcert.

3. Place the Certificate in the Client's Trusted Store

   Add the certificate to the client's trusted stores in Internet Explorer on your computer (Tools > Internet Options > Content > Certificates). If not, you will be prompted to do so the first time you attempt to use Configuration Manager.

   Limitation: There can be one server certificate only in tomcat.keystore.

4. Modify the server.xml File

   Open the server.xml file, located in <Configuration_Manager_installation_directory>\servers\server-0\conf. Locate the section beginning with

   Connector port="8143"

   which appears in comments. Activate the script by removing the comment character and add the following attributes to the HTTPS connector:

   keystoreFile="<tomcat.keystore file location>" (see step 2)
   keystorePass="<password>"

   Comment out the following line:

   <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />

   Note You must not block the HTTP connection port. If you want to block HTTP communication, you can use a firewall for this purpose.

5. Restart the Server

   Restart the Configuration Manager server.

6. Verify the Server Security

   To verify that the Configuration Manager Server is secure, enter the following URL in the Web browser: https://<Configuration Manager Server name or IP address>:8143/cnc.

7. In Configuration Manger, go to Settings>Application Management>Mail Settings and change the protocol and port in Configuration Manager full URL, according to the values above.

8. In UCMDB, go to Infrastructure Settings Manager>General Settings and change the protocol and port in the Configuration Manager URL, according to the values above.

Tip If you fail to establish a connection, try using a different browser or upgrade to a newer version of the browser.