Unsupported content This version of the product has reached end of support. The documentation is available for your convenience. However, you must be logged in to access it. You will not be able to leave comments.

Importing certificates into BMC Atrium Orchestrator Platform components after upgrades


The imports described on this page are only needed if the certificates being used are not issued by a certificate authority that is already trusted.

Note

These instructions are intended for use with upgrades from 7.6.03 to BAO 7.9.x environments with an external Remedy Single Sign-On authentication service. You do not need to perform these steps if you are using the embedded Remedy Single Sign-On authentication service.

If you are converting your environment from HTTP to HTTPS, complete the procedures in Configuring-BMC-Atrium-Orchestrator-to-use-HTTPS before performing the procedures in this page.

 


Importing Remedy Single Sign-On certificate files to the repository truststore

After upgrading the BMC Atrium Orchestrator platform repository, you need to add the Remedy Single Sign-On certificates to the repository truststore (Located at %REPO_HOME%/jvm/lib/security/cacerts).

Before you perform the following steps, ensure that you copy the certificates from Remedy Single Sign-On, and place them in your environment. Whether to import root, intermediate, and host certificates varies based upon the provider.  

For details about working setting up security with Remedy Single Sign-On, see Remedy SSO Security planning

Note

If Remedy Single Sign-On server is using a certificate issued by a certificate authority (CA) that is already represented in the repository cacerts file, then you need not import root and intermediate certificates.

To import the certificates

  1. Run the following command to import the root certificate.

    %REPO_HOME%/jvm/bin>keytool -importcert -alias myrootcertificate-certificate-provider -trustcacerts -file %root_certificate_location%/root-certificate -keystore %trust_store_location%/truststore
  2. Run the following command to import the intermediate certificate.

    %REPO_HOME%/jvm/bin>keytool -importcert -alias myintermdiate-certificate-provider  -trustcacerts -file %intermediate_certificate_location%/intermediate-certificate -keystore %trust_store_location%/truststore
  3. Run the following command to add or import the host certificate.

    %REPO_HOME%/jvm/bin>keytool -importcert -alias myhostcertificate-certificate-provider  -trustcacerts -file %host_certificate_location%/host-certificate -keystore %trust_store_location%/truststore

    Note

    If you have different certificates for individual host components, such as BMC Remedy Single Sign-On or the repository, then you need to add the host certificate to the truststore file.

Importing repository certificate files after upgrading CDP

After you upgrade the CDP, the root certificate gets copied from the repository cacerts file to the jssecacerts file (located at %CDP_HOME%/jvm/lib/security/jssecacerts).

  1. To verify that entry in the jssecacerts file is created, run the following command.

    %CDP_HOME%/jvm/bin>keytool -list -v keystore ../lib/security/jssecacerts > %outputfile_location%/test.txt

     

  2. When you open the test.txt file an entry for root certificate in the jssecacerts file is visible.
    You can manually import intermediate certificate into the jssecacerts file using the same command, as described in Adding certificate files while upgrading the repository.

Importing certificate files after upgrading other peers

The HTTPS certificate for each of the servers listed needs to be copied to the trust store (cacerts and jssecacerts) of each of the paired clients. The following table lists the BMC Atrium Orchestrator client/server communication relationships for each type of component.

Client relationships

Client 

Server

CDP

Repository, HA-CDP (in a high-availability environment), CDP (for Orca and Legacy web services)

HA-CDP

Repository, CDP

Repository

Repository

Note

In environments that have multiple repositories, each repository needs to import the certificate of the repository with which it will communicate.

AP

CDP, AP (for Legacy web services)

LAP

CDP

BMC Atrium Orchestrator Development Studio

Repository, CDP

BMC Atrium Orchestrator Operator Control Panel

CDP

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*