How to Configure Confidential Manager Communication Encryption

This procedure describes how to change the Confidential Manager communication encryption settings on the UCMDB Server. These settings specify how the communication between the Confidential Manager client and the Confidential Manager server is encrypted. This change is automatically sent to Probes (as an encrypted string), unless the UCMDB server is configured to not automatically do this. For details, see Disable Automatic Synchronization of the Confidential Manager Client Authentication and Encryption Settings Between the Server and Probes.

1. On the UCMDB server, launch the Web browser and enter the following address: https://localhost:8443/jmx-console.
2. Click UCMDB:service=Security Services to open the JMX MBEAN View page.
3. Click the CMGetConfiguration method.

4. Click Invoke.

   The XML of the current Confidential Manager configuration is displayed.

5. Copy the contents of the displayed XML.
6. Navigate back to the Security Services JMX MBean View page.
7. Click the CMSetConfiguration method.
8. Paste the copied XML into the Value field.

9. Update the relevant transport-related settings and click Invoke.

   Example:

   <transport>

   <encryptTransportMode>true</encryptTransportMode>

   <CMEncryptionDecryption>

   <encryptDecryptInitString>radiohead</encryptDecryptInitString>

   <cryptoSource>lw</cryptoSource>

   <lwJCEPBECompatibilityMode>true</lwJCEPBECompatibilityMode>

   <cipherType>symmetricBlockCipher</cipherType>

   <engineName>AES</engineName>

   <algorithmModeName>CBC</algorithmModeName>

   <algorithmPaddingName>PKCS7Padding</algorithmPaddingName>

   <keySize>256</keySize>

   <pbeCount>20</pbeCount>

   <pbeDigestAlgorithm>SHA1</pbeDigestAlgorithm>

   <encodingMode>Base64Url</encodingMode>

   <useMacWithCrypto>false</useMacWithCrypto>

   <macType>hmac</macType>

   <macKeySize>256</macKeySize>

   <macHashName>SHA256</macHashName>

   </CMEncryptionDecryption>

   </transport>

For details about the values that can be updated, see Confidential Manager Encryption Settings.