Enable SSL on the Server Machine with a Certificate from a Certification Authority - Configuration Manager

For Configuration Manager, in order to use a certificate issued by a Certification Authority (CA) the keystore must be in Java format. The following example explains how to format the keystore for a Windows machine.

1. Prerequisites

   Before starting the following procedure, remove the old tomcat.keystore file located in the <Configuration_Manager_installation_directory>\java\windows\x86_64\lib\security\ folder or the <Configuration Manager installation directory>\java\linux\x86_64\lib\security\ folder (whichever is relevant), if it exists.

2. Generate a Server Keystore

   1. Generate a CA signed certificate and install it on Windows.

   2. Export the certificate into a *.pfx file (including private keys) using Microsoft Management Console (mmc.exe).

      Enter any string as the password for the pfx file. (You are asked for this password when converting the keystore type to a JAVA keystore.)
      The .pfx file now contains a public certificate and a private key and is password protected.

      Copy the .pfx file you created to the following folder: <Configuration_Manager_installation_directory>\java\windows\x86_64\lib\security.

   3. Open the command prompt and change the directory to <Configuration_Manager_installation_directory>\java\bin.

      Change the keystore type from PKCS12 to a JAVA keystore by running the following command:

      keytool -importkeystore -srckeystore <Configuration_Manager_installation_directory>\conf\security\<pfx file name> -srcstoretype PKCS12 -destkeystore tomcat.keystore
      

      You are asked for the source (.pfx) keystore password. This is the password you supplied when creating the pfx file in step b.

3. Modify the server.xml File

   Open the server.xml file, located in <Configuration_Manager_installation_directory>\servers\server-0\conf. Locate the section beginning with

   Connector port="8143"

   which appears in comments. Activate the script by removing the comment character and add the following two lines:

   keystoreFile="../../java/lib/security/tomcat.keystore"
keystorePass="password" />

   Comment out the following line:

   <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />

   Note You must not block the HTTP connection port. If you want to block HTTP communication, you can use a firewall for this purpose.

4. Restart the Server

   Restart the Configuration Manager server.

5. Verify the Server Security

   To verify that the Configuration Manager server is secure, enter the following URL in the Web browser: https://<Configuration Manager Server name or IP address>:8143/cnc.

6. In Configuration Manger, go to Settings>Application Management> Mail Settings and change the protocol and port in Configuration Manager full URL, according to the values above.

7. In UCMDB, go to Infrastructure Settings Manager>General Settings and change the protocol and port in Configuration Manager URL, according to the values above.

Limitation: There can be one server certificate only in tomcat.keystore.