Use > Hardening > Using a Reverse Proxy > Connect the Data Flow Probe by Reverse Proxy or Load Balancer Using Mutual Authentication

Connect the Data Flow Probe by Reverse Proxy or Load Balancer Using Mutual Authentication

Perform the following procedure to connect the Data Flow Probe through a reverse proxy or load balancer using mutual authentication. This procedure applies to the following configuration:

  • Mutual SSL authentication between the probe and a reverse proxy or load balancer based on a client certificate provided by the probe and required by the reverse proxy or load balancer.
  • A regular SSL connection between the reverse proxy or load balancer and the UCMDB server.

Note The following instructions use the cKeyStoreFile keystore as the Probe keystore. This is a predefined client keystore that is part of the Data Flow Probe installation and contains a self-signed certificates. For details, see Server and Data Flow Probe Default Keystore and Truststore.

It is recommended to create a new, unique keystore containing a newly generated private key. For details, see Create a Keystore for the Data Flow Probe.

Obtain a Certificate from a Certification Authority

Obtain the CA root certificate and import it into the following locations:

  • the Data Flow Probe truststore
  • the Data Flow Probe JVM cacerts
  • the UCMDB server truststore
  • the reverse proxy truststore

  1. Import the CA root certificate into the Data Flow Probe truststore.

    1. Place the CA root certificate in the following directory: <DataFlowProbe_install_dir>\conf\security\<certificate file name>.

    2. Import the CA root certificate into the Data Flow truststore by running the following script:

      <DataFlowProbe_install_dir>\bin\jre\bin\keytool.exe -import -trustcacerts -alias <YourAlias> -file C:\UCMDB\DataFlowProbe\conf\security\<certificate file name> -keystore <DataFlowProbe_install_dir>\conf\security\HPProbeTrustStore.jks

      The default password is: logomania.

  2. Import the CA root certificate into the Data Flow Probe JVM cacerts by running the following script:

    <DataFlowProbe_install_dir>\bin\jre\bin\keytool.exe -import -trustcacerts -alias <YourAlias> -file <DataFlowProbe_install_dir>\conf\security\<certificate file name> -keystore <DataFlowProbe_install_dir>\bin\jre\lib\security\cacerts

    The default password is: changeit.

  3. Import the CA root certificate into the UCMDB truststore.

    1. Place the CA root certificate in the following directory: <UCMDB installation directory>\conf\security\<certificate file name>.

    2. Import the CA root certificate into the UCMDB truststore by running the following script:

      <UCMDB installation directory>\bin\jre\bin\keytool.exe -import -trustcacerts -alias <YourAlias> -file <UCMDB installation directory>\conf\security\<ceritificate file name> -keystore <UCMDB installation directory>\conf\security\sever.truststore

      When prompted, enter your <truststore password>. If you did not change the default password, it is hppass.

  4. Import the CA root certificate into the reverse proxy truststore. This is step is vendor dependent.

Convert the Certificate to a Java Keystore

Obtain the client certificate (and private key) for the Data Flow Probe from your Certificate Authority (CA) in the PFX/PKCS12 format and convert it to a Java keystore by running the following script:

<DataFlowProbe_install_dir>\bin\jre\bin\keytool.exe -importkeystore -srckeystore <PFX keystore full path> -destkeystore <new destination keystore full path> -srcstoretype PKCS12

You will be prompted for the source and destination keystore passwords.

For the source keystore password, use the same password that was used when exporting the PFX keystore.

The default destination keystore password for the Data Flow Probe keystore is: logomania.

Note If you entered a different destination keystore password from the default Data Flow Probe keystore password (logomania), you will need to supply the new password in encrypted format in the <DataFlowProbe_install_dir>\conf\ssl.properties file (javax.net.ssl.keyStorePassword). For details, see Encrypt the Probe Keystore and Truststore Passwords.

Place new keystore in the following directory: <DataFlowProbe_install_dir>\conf\security.

Caution Do not overwrite the hpprobeKeyStore.jks file.

Change the SSL Properties File to Use the Newly Created Keystore

Set the keystore containing the client certificate in the <DataFlowProbe_install_dir>\conf\ssl.properties file to javax.net.ssl.keyStore.

If the password to your keystore is not the default Data Flow Probe keystore password (logomania), then update the javax.net.ssl.keyStorePassword after encrypting it. For detail on encrypting the password, see Encrypt the Probe Keystore and Truststore Passwords.

Review the Data Flow Probe Configuration

Edit the <DataFlowProbe_install_dir>\conf\DataFlowProbe.properties file as follows:

appilog.agent.probe.protocol = HTTPS
serverName = <reverse proxy server address>    
serverPortHttps = <the HTTPS port that the reverse proxy listens to in order to redirect requests to the UCMDB>

Configure UCMDB to Work Using SSL

For details, see Enabling Secure Sockets Layer (SSL) Communication.

If the UCMDB server certificate is created by the same CA that created the rest of the certificates in this procedure, the reverse proxy or load balancer trusts the UCMDB certificate.

Send Help Center feedback