Administer > Configure SSL

Configure SSL

Note If you disable SSL support, you compromise your system's security. You will be vulnerable to data sniffing and other security attacks.

To install and configure SSL support on Tomcat:

  1. Create a keystore file to store the server's private key and self-signed certificate by running one of the following commands:

    • For Windows: %JAVA_HOME%\bin\keytool -genkey -alias tomcat -keyalg RSA

    • For Unix: $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA

    For both commands, use the password value changeit (for all other fields in the console dialog that opens, you can use any value).

  2. In the $CATALINA_BASE/conf/server.xml file (where $CATALINA_BASE is the directory in which you installed Tomcat), do the following:

    • Remove comments from the entry SSL HTTP/1.1 Connector.
    • Set protocol="org.apache.coyote.http11.Http11Protocol" instead of protocol="HTTP/1.1".

      This command defines a Java (JSSE) connector, regardless of whether or not the APR library is loaded.

    • Change the values of <keystore_location> and <keystore_pass>. This action is relevant only if the CMS UI is installed with Preconfigured Apache Tomcat Server, and you create a new keystore file.

    Note  

    • This step is relevant only for the CMS UI installed on an existing Tomcat.
    • For a full description on how to configure server.xml to use SSL, see the Apache Tomcat official site: http://tomcat.apache.org/tomcat-8.5-doc/manager-howto.html
  3. Restart the Tomcat server.

To use the HTTPS protocol for connection to the UCMDB server:

  1. In the ucmdb_browser_config.xml file, assign the value https to the tag<protocol> and assign the UCMDB server HTTPS port value (8443 by default) to the tag <port>.
  2. Download the UCMDB server public certificate to the CMS UI machine (if you use SSL on the UCMDB server, the UCMDB administrator can provide you with this certificate), and import it into the cacerts trust store on the JRE that is going to connect to the server by running the following command:

    "%JAVA_HOME%\bin\keytool" -import -alias ucmdb -trustcacerts -file <UCMDB-Server-certificate-file> -keystore "%JAVA_HOME%\jre\lib\security\cacerts"

    where <UCMDB-Server-certificate-file> is the full path to the UCMDB server public certificate file.

  3. Restart the Tomcat server.