Enable SSL on the Server Machine With a Certificate from a Certification Authority - UCMDB

To use a certificate issued by a Certification Authority (CA), the keystore must be in Java format. The following example explains how to format the keystore for a Windows machine.

1. Prerequisites

   Before starting the following procedure, remove the old server.keystore located in C:\UCMDB\UCMDBServer\conf\security\server.keystore.

2. Generate a Server Keystore

   1. Generate a CA signed certificate and install it on Windows.

   2. Export the certificate into a *.pfx file (including private keys) using Microsoft Management Console (mmc.exe).

      Enter any string as the password for the pfx file. (You are asked for this password when converting the keystore type to a JAVA keystore.) The .pfx file now contains a public certificate and a private key and is password protected.

      Important The password must be at least eight characters in length, and to include at least one of each of the four following types of characters:

      • Uppercase alphabetic characters
      • Lowercase alphabetic characters
      • Numeric characters

      • Symbol characters :/._+-[]

   3. Copy the .pfx file you created to the following folder: C:\UCMDB\UCMDBServer\conf\security.

   4. Open the command prompt and change the directory to C:\UCMDB\UCMDBServer\bin\jre\bin.

      Change the keystore type from PKCS12 to a JAVA keystore by running the following command:

      keytool -importkeystore -srckeystore c:\UCMDB\UCMDBServer\conf\security\<pfx file name> -srcstoretype PKCS12 -destkeystore server.keystore

      You are asked for the source (.pfx) keystore password. This is the password you supplied when creating the pfx file in step b.)

   5. You are asked to provide the password for the destination keystore.

      The destination keystore is the server.keystore file. The password must be the same as the one set at upgrade, or through the changeKeystorePassword JMX method in UCMDB:service=Security Services.

   6. After generating the certificate, disable HTTP port 8080. For details, see Enable or Disable HTTP/HTTPS Ports.

   7. If at step 2.e you used another password than the one used by UCMDB server, change the password of the server by running the changeKeystorePassword JMX method.

      Note Check that HTTPS communication works before closing the HTTP port.

   8. Add the certificate into all probes truststore by following the instructions in Enable SSL with Server (One-Way) Authentication.

      Note For integration service, this is also required. Make sure you follow the same steps.

3. Restart the UCMDB Server

4. Verify the Server Security

   To verify that the UCMDB Server is secure, enter the following URL in the Web browser: https://<UCMDB Server name or IP address>:8443/ucmdb-ui.

   Caution There can be one server certificate only in server.keystore.