Configure Configuration Manager to Work with UCMDB Using SSL

You can configure Configuration Manager to work with UCMDB using Secure Sockets Layer (SSL). The SSL connector on port 8443 is enabled by default in UCMDB.

1. Go to <UCMDB installation directory>\bin\jre\bin and run the following command:

   keytool -export -alias hpcert -keystore <UCMDB_server_directory>
\conf\security\server.keystore -storepass <keystore password> -file <certificatefile>

2. Copy the certificate file to a temporary location on the local Configuration Manager machine.

3. Perform a new installation or reconfigure an existing installation of Configuration Manager. For instructions, see the relevant sections in the interactive Universal CMDB Deployment Guide.

   In the UCMDB configuration screen, set the protocol to HTTPS, and choose the certificate file that you copied in step 2.

4. Copy hpcert.cer to the server machine in the <Configuration_Manager_installation_directory>\java\windows\x86_64\bin folder.

5. On the server machine, import the certificate into the trust store (cacerts) using the keytool utility with the following command:

   <Configuration_Manager_installation_directory>\java\bin\keytool.exe ‑import -alias hp -file hpcert.cer -keystore <Configuration_Manager_installation_directory>\java\windows\x86_64\lib\security\cacerts

6. Copy hpcert.cer to the server machine in the <Configuration_Manager_installation_directory>\java\ windows\x86_64\lib\security folder.

7. Create a server keystore (JKS type) with a self-signed certificate and matching private key. From the <Configuration_Manager_installation_directory>\java\windows\x86_64\bin folder, run the following command:

   keytool –genkey –alias tomcat –keyalg RSA –keystore <Configuration_Manager_installation_directory>\java\windows\x86_64\lib\security\tomcat.keystore

   1. Enter a keystore password.
   2. For the question: What is your first and last name?, enter the Configuration Manager Web server name and enter the other parameters according to your organization.
   3. Enter a key password. The key password MUST be the same as the keystore password. A JKS keystore is created named tomcat.keystore, with a server certificate named hpcert.

8. Modify the server.xml file as follows:

   1. Open the server.xml file, located in <Configuration_Manager_installation_directory>\servers\server-0\conf folder. Locate the section beginning with:

      Connector port="8143"

      which appears as a comment. Activate the script by removing the comment character and add the following lines:

      keystoreFile="<Configuration_Manager_installation_directory>\java\windows\x86_64\lib\security\tomcat.keystore"
      keystorePass="password"
      truststoreFile="<Configuration_Manager_installation_directory>\java\windows\x86_64\lib\security\cacerts"
      truststorePass="changeit" />

   2. Comment out the following line:

      <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />

9. Restart the server.

To configure Configuration Manager to work with other products (such as load balancers) using SSL, import the security certificate of the product to the Configuration Manager truststore (default JRE truststore) by running the following command:

<CM_JAVA_HOME>\bin\keytool -import -trustcacerts -alias <alias> -keystore
<CM_JAVA_HOME>\lib\security\cacerts -storepass changeit -file <certificatefile>