Enable SSL with a Certificate from a Certification Authority

For CMS UI standalone, in order to use a certificate issued by a Certification Authority (CA) the keystore must be in Java format. The following example explains how to format the keystore for a Windows machine.

1. Prerequisites

   Before starting the following procedure, if you already have a browser.keystore file, remove it from the <CMS_UI_installation_directory>\conf folder.

2. Generate a Server Keystore

   1. Generate a CA signed certificate and install it on Windows.

   2. Export the certificate into a *.pfx file (including private keys) using Microsoft Management Console (mmc.exe).

      Enter any string as the password for the pfx file. (You are asked for this password when converting the keystore type to a JAVA keystore.)
      The .pfx file now contains a public certificate and a private key and is password protected.

      Copy the .pfx file you created to the following folder: <CMS_UI_installation_directory>\conf.

   3. Open the command prompt and change the directory to %JAVA_HOME%\bin.

      Change the keystore type from PKCS12 to a JAVA keystore by running the following command:

      keytool -importkeystore -srckeystore <CMS_UI_installation_directory>\conf\<pfx file name> -srcstoretype PKCS12 -destkeystore CMS_UI_installation_directory\conf\browser.keystore
      

      You are asked for the source (.pfx) keystore password. This is the password you supplied when creating the pfx file in step b.

3. Modify the server.xml File

   Open the server.xml file, located in <CMS_installation_directory>\conf. Locate the section beginning with

   Connector port="8443"

   which appears in comments. Activate the script by removing the comment character and add the following two lines:

   keystoreFile="CMS_UI_installation_directory\conf\browser.keystore"
keystorePass="password" />

   Comment out the following line, if applicable:

   <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />

   Note Check that HTTPS communication works before closing the HTTP port.

4. Restart the Tomcat Server

   Restart the Tomcat server.

5. Verify the Server Security

   To verify that the CMS UI is secure, enter the following URL in the Web browser: https://<CMS_UI name or IP address>:8443/ucmdb-browser.

6. In UCMDB, go to Infrastructure Settings Manager>General Settings and change the protocol and port in UCMDB Browser URL, according to the values above.