Enabling SSL on Windows
This topic describes how to enable HTTP on Windows for all the BMC Cloud Lifecycle Management components. It also provides detailed configuration steps to make the secured communication between the components.
- CLM applications that support HTTPS on SSL during installation
- Before you begin
- To create a Root CA certificate using OpenSSL
- To import self-signed certificates for new 4.6 installations
- To configure the Mid Tier SSL
- To integrate the Mid Tier with Platform Manager
- To configure Atrium Web Services SSL
- To integrate Atrium Web Services with BMC Network Automation
- To configure SSL with BMC Server Automation
- To configure SSL with BMC Server Automation and Platform Manager
- To configure BMC Network Automation with SSL
- To configure Platform Manager from HTTPS to HTTP with a Self-Signed Certificate
- To configure Platform Manager from HTTP to HTTPS with a Self-Signed Certificate
- To modify the Platform Manager integration with SSL
- To configure BMC Capacity Optimization with SSL
- To integrate BMC Capacity Optimization and Platform Manager changes into SSL
- To configure BMC Atrium Orchestrator with SSL
- To configure BMC Server Automation and Atrium Orchestrator with SSL
- To configure Atrium Orchestrator and Platform Manager with SSL
- To configure Atrium Orchestrator and ITSM with SSL
- To configure Cloud Portal Web Application from HTTP to HTTPS with a Self-Signed Certificate
- To configure Cloud Portal Web Application from HTTPS to HTTP with a Self-Signed Certificate
- To configure CLM Self-Checker from HTTP to HTTPS with a Self-Signed Certificate
- To configure CLM Self-Checker from HTTPS to HTTP with a Self-Signed Certificate
- To configure BMC MyIT from HTTP to HTTPS with a Self-Signed Certificate
- Related topic
CLM applications that support HTTPS on SSL during installation
The following table lists the CLM applications that support HTTPS on SSL during installation:
Product | Self-sign certificate? | Notes on integration path |
---|---|---|
Platform Manager | Yes | Import the Platform Manager cacerts file into the JRE of the following products:
|
Cloud Portal Web Application | Yes | Import Self-Checker certificate to display the Dashboard Data. |
CLM Self-Check Monitor | Yes |
|
BMC Server Automation (BBSA) | Yes |
|
BMC Network Automation (BBNA) | Yes |
|
Atrium Core Web Services | Yes | Default HTTPS port is 7776. If you use port 7776, update information in the BMC Network Automation console. |
Mid Tier | No |
|
BMC Atrium Orchestrator | No |
|
Before you begin
- Take a snapshot of your VMs or back up your servers. This precaution is necessary if you make a mistake and need to roll back your changes!
- When importing certificates, keypairs, or keystores, use the JRE embedded with the product or the latest version of JRE/Java installed on your host.
- If you are using a Google Chrome browser and encounter the weak ephemeral Diffie-Hellman key error, see KA428034 for a helpful workaround. To review this workaround in context, see To configure AMREPO to work with SSL.
To create a Root CA certificate using OpenSSL
- Download and install 64-bit OpenSSL1.0 on its own host.
For example, download OpenSSL from the Shining Light Productions website. There are multiple OpenSSL versions available. Make sure that you install an OpenSSL version that includes the openSSL.cfg file. - Create Keys, Certificates, and CSR folders.
These categories are for placing keys, certificates files, and so on. - Open a command prompt and navigate to the OpenSSL folder.
Generate the key pair for root CA.
Store this key pair in the C:\Keys\RootCA.key file.C:\OpenSSL-Win64\bin>openssl genrsa -out C:\Keys\RootCA.key 2048
Loading 'screen' into random state - done
Generating RSA private key, 2048 bit long modulus
...............++++++
....................................................++++++
e is 65537 (0x10001)- Generate a self signed certificate for CA.
This CA certificate is used across all cloud products as a common certificate. Store the certificate in the RootCA.crt file.Enter the following command:
C:\OpenSSL-Win64\bin>openssl req
-config C:\OpenSSL-Win64\bin\openSSL.cfg
-new -x509 -days 365 -key C:\Keys\RootCA.key
-out C:\Certificates\RootCA.crtCreate a Distinguished Name (DN)..
Make sure that you enter all required information. Many fields contain defaults. Some settings you can leave blank. If you enter a period, the field will be left blank.Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:California
Locality Name (eg, city) []:San Jose
Organization Name (eg, company) [Internet Widgits Pty Ltd]:BMC Software
Organizational Unit Name (eg, section) []:IDD
Common Name (e.g. server FQDN or YOUR name) []:clm-aus-011538.bmc.com
Email Address []:jstamps@bmc.com- Press Enter to create the certificate.
To import self-signed certificates for new 4.6 installations
When you are performing new installations, you must import SSL certificates for Small or Medium deployments.
The following CLM products already have HTTPS/SSL enabled by default:
- Platform Manager
- Self-Check Monitor
- Cloud Portal Web Application
- BMC Network Automation
- BMC Server Automation
- BMC Capacity Optimization (if you assigned HTTPS/8443 over SSL during installation)
If you installed Platform Manager with the installer planner on HTTPS/SSL with Small or Medium deployments, you still must import the cacerts file from the Platform Manager into the JRE on the following products:
- Mid Tier
- Cloud Portal Web Application
- CLM Self-Check Monitor
- Cloud Portal and Database AR System server
Atrium Orchestrator
Copy the cacerts file on the Platform Manager to the product host.
For example, copy the cacerts file from the installed JVM on Platform Manager to the C:\TEMP folder.- Open a command window on the product host.
- Change directories to the JRE version 8 bin directory (for example, C:\Program Files\BMC Software\CloudPortalWebApplication\jre\bin)
Import the keystore (cacerts) certificate in the application cacerts.
Make sure that you understand which JRE your application used during installation. This example imports the keystore certificate into the cacerts of an external JRE used.keyTool -importkeystore -srckeystore "C:\TEMP\cacerts"
-destkeystore "C:\Program Files\Java\jre7\lib\security\cacerts"
-srcstoretype JKS -deststoretype JKS -srcstorepass changeit
-deststorepass changeit -nopromptHowever, this example imports the keystore certificate into the cacerts of the bundled JRE used by the Cloud Portal Web Application (clmui).
keytool -importkeystore -srckeystore "C:\TEMP\cacerts"
-destkeystore "C:\Program Files\BMC Software\CloudPortalWebApplication\jre\lib\security\cacerts"
-srcstoretype JKS -deststoretype JKS -srcstorepass changeit
-deststorepass changeit -noprompt- To monitor Dashboard Data, import the CLM Self-Check Monitor certificate (selfcheckSslCertificate.cert) with the JRE used by the Cloud Portal Web Application (whether installed on the Platform Manager or on a separate host) during installation.
The default location of selfcheckSslCertificate.cert is C:\Program Files\BMC Software\SelfChecker\selfchecker\Certificates. - Restart the application service.
For example, restart the BMC CSM Portal service. - Flush the browser cache.
- Clear the Mid Tier Plugins Cache.
- Log on to the application, add and confirm the site exception, and so on.
To configure the Mid Tier SSL
- On the Mid Tier host, create Keys, Certificates, and CSR folders.
- Stop the Mid Tier Tomcat server.
- Open a command prompt and navigate to the JRE folder.
Create a keypair using the keytool utility.
If the Mid Tier is behind a load balancer, use CN as the load balancer name. But here it is vw-aus-clnidd03.C:\Program Files\Java\jre7\bin>keytool.exe -genkey
-alias tomcat -keyalg RSA -keysize 2048
-keypass "changeit" -storepass "changeit" -keystore C:\Keys\keystore.jksAt the prompts, enter the required information to create the keypair, and then press Enter.
C:\Program Files\Java\jre7\bin>keytool.exe -genkey -alias tomcat
-keyalg RSA -keysize 2048 -keypass "changeit"
-storepass "changeit" -keystore C:\Keys\keystore.jks
What is your first and last name?
[Unknown]: vw-aus-clnidd03
What is the name of your organizational unit?
[Unknown]: IDD
What is the name of your organization?
[Unknown]: BMC
What is the name of your City or Locality?
[Unknown]: SAN JOSE
What is the name of your State or Province?
[Unknown]: CA
What is the two-letter country code for this unit?
[Unknown]: US
Is CN=vw-aus-clnidd03, OU=IDD, O=BMC, L=SAN JOSE, ST=CA, C=US correct?
[no]: yesCreate the Certificate Signing Request (CSR) from Mid Tier primary to retrieve the certificate from CA (i.e. CLM).
C:\Program Files\Java\jre7\bin>keytool.exe
-certreq -keyalg RSA -alias tomcat -file C:\CSR\mt.csr
-keystore C:\Keys\keystore.jks
Enter keystore password:At the prompt, enter changeit as the password.
Copy the mt.csr file to the CSR folder where OpenSSL is installed so that you can generate a certificate, and then run the following command on the OpenSSL computer:
C:\OpenSSL-Win64\bin>openssl x509 -req -days 365
-in C:\CSR\mt.csr -CA C:\Certificates\RootCA.crt
-CAkey C:\Keys\RootCA.key -set_serial 01
-out C:\Certificates\mt_server.crt
Loading 'screen' into random state - done
Signature ok
subject=/C=US/ST=CA/L=SAN JOSE/O=BMC/OU=IDD/CN=vw-aus-clnidd03
Getting CA Private Key- After the certificate is generated (mt_server.crt) in the Certificates folder, copy mt_server.crt and RootCA.crt to the Mid Tier primary and secondary computers into their Certificates folder.
On the Mid Tier primary and secondary computers, import the Root CA certificate:
C:\Program Files\Java\jre7\bin>keytool.exe
-import -alias root
-keystore C:\Keys\keystore.jks
-trustcacerts -file C:\Certificates\RootCA.crt
Enter keystore password:
Owner: EMAILADDRESS=jstamps@bmc.com, CN=JOHN, OU=IDD, O=BMC, L=SJ, ST=CA, C=US
Issuer: EMAILADDRESS=jstamps@bmc.com, CN=JOHN, OU=IDD, O=BMC, L=SJ, ST=CA, C=US
...
Trust this certificate? [no]: yes
Certificate was added to keystore
C:\Program Files\Java\jre7\bin>- At the prompt, enter changeit as the password.
- When you see the Trust this certificate prompt, enter yes.
Your certificate is added to the keystore.
Import the mt_server.crt certificate:
C:\Program Files\Java\jre7\bin>keytool.exe
-import -alias tomcat
-keystore C:\Keys\keystore.jks -trustcacerts
-file C:\Certificates\mt_server.crt
Enter keystore password:
Certificate reply was installed in keystoreAt the prompt, enter changeit as the password. Your certificate reply is installed in the keystore.
- Open the server.xml file (in Windows, the default location is C:\Program Files\Apache Software Foundation\Tomcat6.0\conf\server.xml) in a text editor and uncomment the SSL related sections.
Search for the following text and uncomment out the Connector port section:
<!-- Define a SSL HTTP/1.1 Connector on port 8443
This connector uses the JSSE configuration, when using APR, the
connector should be using the OpenSSL style configuration
described in the APR documentation -->
<!--
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
-->Modify the Connector port information as follows:
<Connector port="9443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="C:\Keys\keystore.jks"
keystorePass="<passwordMustEqualYourKeystorePassword>"
/>Here you change the connector port to 9443 and add the keyStore file location and keystore password.
Save the server.xml .
- Start the Tomcat server.
- Verify your changes to the Mid Tier or Mid Tier Load Balancer by accessing the following URL:
https://midTier:9443/arsys (where 9443 is SSL port)
https://loadBalancer:9443/arsys - Add and confirm any security restrictions in your browser.
- When you access the Mid Tier the first time, review the certificate details.
- Review the General tab and verify who the certificate is issued to and who it was issued by.
- Click the Details tab and, review the certificate path or hierarchy.
- Continue logging on to the Cloud Portal and Database AR System server.
To integrate the Mid Tier with Platform Manager
- Open the CMF:PluginConfiguration form in Search mode in the Cloud Portal and Database AR System server.
- Search for the CallBackURI record.
- Edit the CallBackURI from http to https.
- Edit the port to 9443.
- Save the record.
- Copy the RootCA.crt certificate from the Mid Tier server to the Platform Manager server (for example, to a Certificates folder).
- Open a command window and change directories to C:\Program Files\BMC Software\BMCCloudLifeCycleManagement\JVM_1.7.0_55\bin (by default).
- Back up the ..\JVM_1.7.0_55\lib\security\cacerts file.
Import the certificate:
keytool.exe -import -alias root
-keystore "C:\Program Files\BMC Software\BMCCloudLifeCycleManagement
\JVM_1.7.0_55\lib\security\cacerts"
-trustcacerts -file "C:\Certificates\RootCA.crt"
Enter keystore password:
Re-enter new password:
...
Trust this certificate? [no]: yes
Certificate was added to keystore- At the prompt, enter changeit as the password.
- When you see the Trust this certificate prompt, enter yes.
Your certificate is added to the keystore. - Restart the services in the following order – first BMC CSM on Platform Manager and second the Cloud Portal and Database AR System server.
To configure Atrium Web Services SSL
The following instructions apply only to Small or Medium deployments.
- On the primary Atrium Core Web Services Registry host, create Keys, Certificates, and CSR folders.
- Stop the Atrium Tomcat server.
- Open a command prompt and navigate to the JRE folder.
Create a keypair using the keytool utility.
If the Atrium Web Services are behind a load balancer, you can use CN as the load-balancer name. But here it is vw-aus-clnidd01.C:\Program Files\Java\jre7\bin>keytool.exe -genkey
-alias tomcat -keyalg RSA -keysize 2048
-keypass "changeit" -storepass "changeit"
-keystore C:\Keys\keystore.jksAt the prompts, enter the required information to create the keypair, and then press Enter.
keytool.exe -genkey -alias tomcat -keyalg RSA -keysize 2048
-keypass "changeit" -storepass "changeit" -keystore C:\Keys\keystore.jks
What is your first and last name?
[Unknown]: vw-aus-clnidd01
What is the name of your organizational unit?
[Unknown]: IDD
What is the name of your organization?
[Unknown]: BMC
What is the name of your City or Locality?
[Unknown]: SAN JOSE
What is the name of your State or Province?
[Unknown]: CA
What is the two-letter country code for this unit?
[Unknown]: US
Is CN=vw-aus-clnidd01, OU=IDD, O=BMC, L=SAN JOSE, ST=CA, C=US correct?
[no]: yesCreate the Certificate Signing Request (CSR) from Atrium Web Services primary to retrieve the certificate from CA (that is, CLM).
C:\Program Files\Java\jre7\bin>keytool.exe -certreq
-keyalg RSA -alias tomcat
-file C:\CSR\aws.csr -keystore C:\Keys\keystore.jks
Enter keystore password:At the prompt, enter changeit as the password.
Copy the aws.csr file to the CSR folder where OpenSSL is installed so that you can generate a certificate (aws_server.crt), and then run the following command on the OpenSSL computer:
C:\OpenSSL-Win64\bin>openssl x509 -req -days 365
-in C:\CSR\aws.csr -CA C:\Certificates\RootCA.crt
-CAkey C:\Keys\RootCA.key -set_serial 01
-out C:\Certificates\aws_server.crt
Loading 'screen' into random state - done
Signature ok
subject=/C=US/ST=CA/L=SAN JOSE/O=BMC/OU=IDD/CN=vw-aus-clnidd01
Getting CA Private Key- After the certificate is generated (aws_server.crt) in the Certificates folder, copy aws_server.crt and RootCA.crt to the AWS primary and secondary hosts into their Certificates folder.
On the AWS primary and secondary hosts, import the Root CA certificate:
C:\Program Files\Java\jre7\bin>keytool.exe -import
-alias root -keystore C:\Keys\keystore.jks
-trustcacerts -file C:\Certificates\RootCA.crt
Enter keystore password:
Owner: EMAILADDRESS=jstamps@bmc.com,
CN=vw-aus-clmidd05.bmc.com, OU=IDD,
O=BMC, L=SAN JOSE, ST=CA, C=US
...
Trust this certificate? [no]: yes
Certificate was added to keystore- At the prompt, enter changeit as the password.
- When you see the Trust this certificate prompt, enter yes.
Your certificate is added to the keystore.
- At the prompt, enter changeit as the password.
Import the aws_server.crt certificate:
C:\Program Files\Java\jre7\bin>keytool.exe -import
-alias tomcat -keystore C:\Keys\keystore.jks
-trustcacerts -file C:\Certificates\aws_server.crt
Enter keystore password:
Certificate reply was installed in keystoreYour certificate reply is installed in the keystore.
- Open the server.xml file (in Windows, the default location is C:\Program Files\BMC Software\Atrium Web Registry\shared\tomcat\conf\server.xml) in a text editor and uncomment the SSL related sections.
Search for the following text and uncomment out the Connector port section:
<!-- Define a SSL HTTP/1.1 Connector on port 8443
This connector uses the JSSE configuration, when using APR, the
connector should be using the OpenSSL style configuration
described in the APR documentation -->
<!--
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
-->Modify the Connector port information as follows:
<Connector port="9443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="C:\Keys\keystore.jks"
/>Here you change the connector port to 9443 and add the keyStore file location.
- Save the server.xml .
- Start the AWS Tomcat server.
- Verify your changes to the AWS or AWS Load Balancer by accessing the following URL:
https://<AWS>:9443 (where 9443 is SSL port)
https://<LoadBalancer>:9443 - Add and confirm any security restrictions in your browser.
- When you access AWS UDDI the first time, review the certificate details.
- Review who the certificate is issued to (for example, vw-aus-clnidd01) and who the certificate was issued by (for example, bmc.com).
- Review the certificate path or hierarchy.
To integrate Atrium Web Services with BMC Network Automation
The following instructions apply only to Small or Medium deployments.
Log on to the Mid Tier to access the Cloud Portal and Database AR System server.
You can use https://<MidTier>:9443/arsys to access the Cloud Portal and Database AR System server.- Open the Server Information form for the Cloud Portal and Database AR System server.
- Click the Advanced tab, and modify the URL in the Default Web Path field with the updated https and port (for example, 9443).
For example, you might enter https://vw-san-clmidd:9443/arsys/. - Restart the Cloud Portal and Database AR System server.
- Log on to BMC Network Automation.
For example, go to https://bnaServer:11443/bca-networks - Click the Admin tab, and navigate to System Admin > System Parameters.
- In the Enable CMDB Integration section, modify the Web Service Endpoint URL field with the updated https and port 9443 URL (for example, https://bnaServer:9443/cmdbws/server/cmdbws.wsdl).
- Click Save.
The BMC Network Automation console verifies your changes. - When you finish, verify that physical location is accessed by BMC Network Automation during POD creation through the Atrium Web Services.
If you have successfully integrated Atrium Web service and BNA SSL communication, go to BMC Network Automation and try to create a POD. The physical location created in the AR System server should be visible in the list during POD creation.
To configure SSL with BMC Server Automation
For more information on using a CA-issued certificate or certificate chain rather than the default self-signed certificate, see Securing communication with CA certificates in the BMC Server Automation documentation.
- On the BMC Server Automation host, create Keys, Certificates, and CSR folders.
- Stop the BladeLogic Application Server.
- Back up the bladelogic.keystore file, located at C:\Program Files\BMC Software\BladeLogic\appserver\br\deployments or C:\Program Files\BMC Software\BladeLogic\NSH\br\deployments and then delete the original.
- Open a command prompt and navigate to the BladeLogic JRE folder (for example, C:\Program Files\BMC Software\BladeLogic\NSH\jre\bin).
On the BMC Server Automation primary host, create a keypair using the keytool utility.
If BMC Server Automation is behind a load balancer, you can use CN as the load-balancer name.keytool.exe -genkey -alias blade -keyalg RSA -keysize 2048
-keypass "<password>" -storepass "<password>"
-keystore "C:\Program Files\BMC Software\BladeLogic\NSH\br\
deployments\_template\bladelogic.keystore"
What is your first and last name?What is your first and last name?
[Unknown]: JOHN STAMPS
What is the name of your organizational unit?
[Unknown]: IDD
What is the name of your organization?
[Unknown]: BMC
What is the name of your City or Locality?
[Unknown]: SAN JOSE
What is the name of your State or Province?
[Unknown]: CA
What is the two-letter country code for this unit?
[Unknown]: US
Is CN=JOHN STAMPS, OU=IDD, O=BMC, L=SAN JOSE, ST=CA, C=US correct?
[no]: yes- At the prompts, enter the required information to create the keypair, and then press Enter.
Create the Certificate Signing Request (CSR) from BMC Server Automation primary to retrieve the certificate from CA (that is, CLM).
keytool.exe -certreq -keyalg RSA -alias blade
-file C:\CSR\blade.csr -keystore "C:\Program Files\BMC Software\
BladeLogic\NSH\br\deployments\_template\bladelogic.keystore"
Enter keystore password:
At the prompt, enter the BMC Server Automation password, not changeit.Copy the blade.csr file to the CSR folder where OpenSSL is installed so that you can generate a certificate (blade.crt), and then run the following command on the OpenSSL computer:
C:\OpenSSL-Win64\bin>openssl x509 -req -days 365
-in C:\CSR\blade.csr -CA C:\Certificates\RootCA.crt
-CAkey C:\Keys\RootCA.key -set_serial 01
-out C:\Certificates\blade.crt
Loading 'screen' into random state - done
Signature ok
subject=/C=US/ST=CA/L=SAN JOSE/O=BMC/OU=IDD/CN=JOHN STAMPS
Getting CA Private Key- After the certificate is generated (blade.crt) in the Certificates folder, copy blade.crt and RootCA.crt to the BMC Server Automation primary host into its Certificates folder.
On the BMC Server Automation primary host, import the Root CA certificate:
keytool.exe -import -alias blade
-keystore "C:\Program Files\BMC Software\BladeLogic\NSH\
br\deployments\_template\bladelogic.keystore"
-trustcacerts -file C:\Certificates\RootCA.crt
Enter keystore password:
Owner: EMAILADDRESS=jstamps@bmc.com, CN=JOHN, OU=IDD,
O=BMC, L=SJ, ST=CA, C=US
Issuer: EMAILADDRESS=jstamps@bmc.com, CN=JOHN,
OU=IDD, O=BMC, L=SJ, ST=CA, C=US
...
Trust this certificate? [no]: yes
Certificate was added to keystore- At the prompt, enter the BMC Server Automation password, not changeit.
- When you see the Trust this certificate prompt, enter yes.
Your certificate is added to the keystore.
Import the blade.crt certificate:
C:\Program Files\BMC Software\BladeLogic\NSH\jre\bin>keytool.exe
-import -alias blade
-keystore "C:\Program Files\BMC Software\BladeLogic\NSH\
br\deployments\_template\bladelogic.keystore"
-trustcacerts -file C:\Certificates\blade.crt
Enter keystore password:
Certificate reply was installed in keystore
Your certificate reply is installed in the keystore.- Copy the bladelogic.keystore file you just created from the _template folder to each of the deployments server folders.
- Start the BladeLogic Application Server.
- Verify your changes to the BMC Server Automation URL by accessing the following link:
https://<BladeLogic>:10843 (where 10843 is the SSL port) - When you access BMC Server Automation URL the first time, review the certificate details.
- Log on to the BladeLogic Application Server.through BMC Server Automation Console.
In the login screen, click Options > Certificates > View to view the certificate. This screen displays the certificate details like issued to clm-hou-bbsa and Issued by CA (for example, CLM). - For BMC Server Automation secondary, follows the relevant steps (typically 1 > 2 > 3 > 12 > 13 >14 >15 >16 >17 in order).
To configure SSL with BMC Server Automation and Platform Manager
- On the Platform Manager host, open the providers.json file.
Change the protocol and the SSL port in the providers.json file for the BBSA_SERVER_PORT attribute value.
For example:
"name" : "BBSA_SERVER_PORT"
},
"attributeValue" : "10843",
"description" : "BBSA Webservices Port",
"guid" : "1a0e98f9-905e-4117-99dd-759f7ad41b71",
"name" : "BBSA_SERVER_PORT"
}, {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttributeValue",
"accessAttribute" : {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttribute",
"datatype" : "STRING",
"description" : "BBSA Server Protocol",
"guid" : "3bf2db7a-af7e-4bc7-8674-63c6df997a75",
"isOptional" : false,
"isPassword" : false,
"modifiableWithoutRestart" : false,
"name" : "BBSA_SERVER_PROTOCOL"
},
"attributeValue" : "https",
"description" : "BBSA Server Protocol",- Save your changes and restart the Platform Manager.
To configure BMC Network Automation with SSL
- On the BMC Network Automation host, create Keys, Certificates, and CSR folders.
- Stop the BCA-Networks Web Server.
- Back up the .keystore file (by default, located at C:\BCA-Networks-Data) and then delete the original.
- On the primary BMC Network Automation host, open a command prompt and navigate to the BCA-Network JRE folder (for example, C:\Program Files\BMC Software\BCA-Networks\java\bin).
Create a keypair using the keytool utility.
If BMC Network Automation is behind a load balancer, you can use CN as the load-balancer name. Use the following syntax so that keytool works properly:C:\Program Files\BMC Software\BCA-Networks\java\bin>keytool.exe
-genkey -alias clm-bna -keyalg RSA -keysize 2048 -keypass "changeit"
-storepass "changeit" -keystore "C:\BCA-Networks-Data\.keystore"
What is your first and last name?
[Unknown]: JOHN STAMPS
What is the name of your organizational unit?
[Unknown]: IDD
What is the name of your organization?
[Unknown]: BMC
What is the name of your City or Locality?
[Unknown]: SAN JOSE
What is the name of your State or Province?
[Unknown]: CA
What is the two-letter country code for this unit?
[Unknown]: US
Is CN=JOHN STAMPS, OU=IDD, O=BMC, L=SAN JOSE, ST=CA, C=US correct?
[no]: yes- At the prompts, enter the required information to create the keypair, and then press Enter.
Create the Certificate Signing Request (CSR) from BMC Network Automation primary to retrieve the certificate from CA (that is, CLM).
keytool.exe -certreq -keyalg RSA -alias clm-bna
-file C:\CSR\clm-bna.csr -keystore "C:\BCA-Networks-Data\.keystore"
Enter keystore password:At the prompt, enter changeit as the password.
Copy the clm-bna.csr file to the CSR folder where OpenSSL is installed so that you can generate a certificate (clm-bna.crt), and then run the following command on the OpenSSL computer:
C:\OpenSSL-Win64\bin>openssl>openssl x509 -req -days 365
-in C:\CSR\clm-bna.csr -CA C:\Certificates\RootCA.crt
-CAkey C:\Keys\RootCA.key -set_serial 04
-out C:\Certificates\clm-bna.crt
Loading 'screen' into random state - done
Signature ok
subject=/C=US/ST=CA/L=SAN JOSE/O=BMC/OU=IDD/CN=clm-bna
Getting CA Private Key- After the certificate is generated (clm-bna.crt) in the Certificates folder, copy clm-bna.crt and RootCA.crt to the BMC Network Automation primary and secondary hosts into their Certificates folder.
On the BMC Network Automation primary and secondary computers, import the first Root CA certificate into the C:\BCA-Networks-Data\.keystore file that we generated:
C:\Program Files\BMC Software\BladeLogic\NSH\jre\bin>keytool.exe
-import -alias root -keystore "C:\BCA-Networks-Data\.keystore"
-trustcacerts -file C:\Certificates\RootCA.crt
Owner: EMAILADDRESS=jstamps@bmc.com, CN=bmc.com,
OU=IDD, O=BMC, L=San Jose, ST=CA, C=US
...
Trust this certificate? [no]: yes
Certificate was added to keystore- At the prompt, enter changeit as the password.
- When you see the Trust this certificate prompt, enter yes.
Your certificate is added to the keystore. - If you have a secondary BMC Network Automation computer, import only the RootCA certificate in the java\cacerts file.
Import Root CA into the C:\Program Files\BMC Software\BCA-Networks\java\lib\security\cacerts file:
C:\Program Files\BMC Software\BCA-Networks\java\bin>keytool.exe
-import -alias root
-keystore "C:\Program Files\BMC Software\BCA-Networks\java\lib\security\cacerts"
-trustcacerts -file C:\certificates\RootCA.crt
Enter keystore password:
Owner: EMAILADDRESS=jstamps@bmc.com, CN=bmc.com, OU=IDD,
O=BMC, L=San Jose, ST=CA, C=US
...
Trust this certificate? [no]: yes
Certificate was added to keystoreImport the blm-bna.crt certificate:
C:\Program Files\BMC Software\BCA-Networks\java\bin>keytool.exe
-import -alias clm-bna -keystore C:\BCA-Networks-Data\.keystore
-trustcacerts -file C:\Certificates\clm-bna.crt
Enter keystore password:
Certificate reply was installed in keystoreYour certificate reply is installed in the keystore.
- Generate the encryption string for changeit.
- Open the BNA maintenance utility (by default, installed in C:\Program Files\BMC Software\BCA-Networks\utility).
- Click the Encrypt tab.
- Enter and confirm the changeit password.
- Click Encrypt to generate the encryption string for changeit.
- Use the generated string for the keystorePassword parameter in the server.xml file (by default, located at C:\Program Files\BMC Software\BCA-Networks\tomcat\conf).
- Start the BCA-Networks Web Server.
- Verify the BNA link by accessing https://<BNA-LB>:443 where 443 is SSL port.
- If you have a load balancer, failover the BNA service and verify that you can able to access the link with Cluster name and with the same certificate it displays.
- When you access the BMC Network Automation URL the first time, review the certificate details, and so on.
To configure Platform Manager from HTTPS to HTTP with a Self-Signed Certificate
Use the following steps to configure HTTPS to HTTP using a Self-Signed Certificate. If you are running HA, you only need to run the following commands on the primary host. SSL-level certification is not required on the secondary HA host.
- Make sure the CSM service is running on the primary Platform Manager host.
- On the primary Platform Manager host, create Keys, Certificates, and CSR folders.
- Back up the keystore file (by default, located at C:\Program Files\BMC Software\BMCCloudLifeCycleManagement\Platform_Manager\security).
- Open a command prompt and navigate to the JRE folder (for example, C:\Program Files\java\jre7\bin).
Create a keypair using the keytool utility and store it at C:\Program Files\BMC Software\BMCCloudLifeCycleManagement\Platform_Manager\security.
keytool.exe -genkey -alias PM -keyalg RSA -keysize 1024
-keypass "changeit" -storepass "changeit"
-keystore "C:\Program Files\BMC Software\BMCCloudLifeCycleManagement\
Platform_Manager\security\keystore"
What is your first and last name?
[Unknown]: clm-hou-pm
What is the name of your organizational unit?
[Unknown]: IDD
What is the name of your organization?
[Unknown]: BMC
What is the name of your City or Locality?
[Unknown]: San Jose
What is the name of your State or Province?
[Unknown]: CA
What is the two-letter country code for this unit?
[Unknown]: US
Is CN=clm-hou-pm, OU=IDD, O=BMC, L=San Jose, ST=CA, C=US correct?
[no]: yesAt the prompts, enter the required information to create the keypair, and then press Enter. For example, use clm-hou-pm as the cluster name.
Create the Certificate Signing Request (PM.csr) to retrieve the certificate from Root CA.
keytool.exe -certreq -keyalg RSA -alias PM
-file C:\CSR\PM.csr
-keystore "C:\Program Files\BMC Software\BMCCloudLifeCycleManagement\
Platform_Manager\security\keystore"
Enter keystore password:At the prompt, enter changeit as the password.
Copy the PM.csr file to the CSR folder where OpenSSL is installed so that you can generate a certificate (PM.crt), and then run the following command on the OpenSSL host:
C:\OpenSSL-Win64\bin>openssl x509 -req -days 365
-in C:\CSR\PM.csr -CA C:\Certificates\RootCA.crt
-CAkey C:\Keys\RootCA.key -set_serial 01 -out C:\Certificates\pm.crt
Loading 'screen' into random state - done
Signature ok
subject=/C=US/ST=CA/L=San Jose/O=BMC/OU=IDD/CN=clm-hou-pm
Getting CA Private Key- After the certificate is generated (PM.crt) in the Certificates folder, copy PM.crt and RootCA.crt to the Platform Manager primary host into the Certificates folder.
On the Platform Manager primary host, import the Root CA certificate:
keytool.exe -import -alias root
-keystore "C:\Program Files\BMC Software\BMCCloudLifeCycleManagement\
Platform_Manager\security\keystore"
-trustcacerts -file C:\Certificates\RootCA.crt
Enter keystore password:
Certificate already exists in system-wide CA keystore under alias <root>
Do you still want to add it to your own keystore? [no]: yes
Certificate was added to keystore- At the prompt, enter changeit as the password.
- If you are prompted that the certificate already exists, enter yes anyway;
Your certificate is added to the keystore.
Import the Root CA certificate into the Platform Manager JVM cacerts file.
keytool.exe -import -alias root
-keystore "C:\Program Files\BMC Software\BMCCloudLifeCycleManagement\
JVM_1.6.0_31\lib\security\cacerts"
-trustcacerts -file C:\Certificates\RootCA.crt
Enter keystore password:
Certificate was added to keystoreImport the PM.crt certificate:
keytool.exe -import -alias PM1
-keystore "C:\Program Files\BMC Software\BMCCloudLifeCycleManagement\
Platform_Manager\security\keystore"
-trustcacerts -file C:\Certificates\PM.crt
Enter keystore password:
Certificate was added to keystoreUpdate the config.ini file (by default, located at C:\Program Files\BMC Software\BMCCloudLifeCycleManagement\Platform_Manager\configuration) with the following parameters:
org.osgi.service.http.port=7070
jetty.port=7070
jetty.ssl.password=changeit
jetty.ssl.keypassword=changeitMake sure to save the config.ini file.
Update the the configuration in the ..\Platform_Manager\csm-bootstrap.properties file with the following changes:
PersistenceNodeProtocol=http
NodeProtocol=http
NodePort=7070
PersistenceNodePort=7070Make sure to save the csm-bootstrap.properties file.
- Update the configuration in the ..\Platform_Manager\configuration\cloudservices.json file with the following changes:
Set the secureJetty attribute value to false and the description to Use HTTP.
{
"cloudClass" : "com.bmc.cloud.model.beans.CloudService",
"accessValues" : [ {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttributeValue",
"accessAttribute" : {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttribute",
"datatype" : "Boolean",
"description" : "Use HTTP",
"guid" : "b15fc770-4119-4cd6-bea6-1efdc5ecc768",
"isOptional" : false,
"isPassword" : false,
"length" : 255,
"modifiableWithoutRestart" : false,
"name" : "secureJetty"
},
"attributeValue" : "false",
"description" : "Use HTTP",
"guid" : "2aacb37d-0b0c-48f2-b85f-e010e3705f49",
"name" : "secureJetty"
}Set the attribute value of Jetty port, CSM Local Port, and CSM Global Registry URL to 7070.
Make sure that you also set the localhost attribute value to "localhost:7070".{
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttributeValue",
"accessAttribute" : {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttribute",
"datatype" : "Integer",
"description" : "Jetty Port",
"guid" : "f1f036cc-7050-4a08-9e00-2a38cedaeef9",
"isOptional" : false,
"isPassword" : false,
"length" : 255,
"modifiableWithoutRestart" : false,
"name" : "jettyPort"
},
"attributeValue" : "7070",
"description" : "Jetty Port",
"guid" : "e2513a26-1c6c-4fd1-9267-d3ff3d00b94a",
"name" : "jettyPort"
}
{
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttributeValue",
"accessAttribute" : {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttribute",
"datatype" : "Integer",
"description" : "CSM Local Port",
"guid" : "9ceda25b-b408-4f38-bf78-26fc8a941ced",
"isOptional" : false,
"isPassword" : false,
"length" : 255,
"modifiableWithoutRestart" : false,
"name" : "csm.local.port"
},
"attributeValue" : "7070",
"description" : "CSM Local Port",
"guid" : "b86fb3c3-d5c8-46dc-8d7d-5be05a392aff",
"name" : "csm.local.port"
}
},{
"cloudClass" : "com.bmc.cloud.model.beans.CloudService",
"accessValues" : [ {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttributeValue",
"accessAttribute" : {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttribute",
"datatype" : "String",
"description" : "CSM Global Registry URL",
"guid" : "5f49c658-e3fb-4ace-95aa-d5c13636a82e",
"isOptional" : false,
"isPassword" : false,
"length" : 255,
"modifiableWithoutRestart" : false,
"name" : "csm.global.url"
},
"attributeValue" : "localhost:7070",
"description" : "CSM Global Registry URL",
"guid" : "45cb9fc3-ac7e-49de-88d4-4d1042c48061",
"name" : "csm.global.url"
}, {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttributeValue",
"accessAttribute" : {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttribute",
"datatype" : "Integer",
"description" : "CSM Local Port",
"guid" : "9ceda25b-b408-4f38-bf78-26fc8a941ced",
"isOptional" : false,
"isPassword" : false,
"length" : 255,
"modifiableWithoutRestart" : false,
"name" : "csm.local.port"
},
"attributeValue" : 7070,
"description" : "CSM Local Port",
"guid" : "80e5622d-4dbc-49de-9ca6-deef7627e7f5",
"name" : "csm.local.port"
} ],
"cloudServiceDefinition" : "/cloudservicedefinition/4bc19dbb-22e5
-4a3d-a294-c3749e2b2947",
"cloudServiceDefinitionObject" : {
"cloudClass" : "com.bmc.cloud.model.beans.CloudServiceDefinition",
"accessAttributes" : [ {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttribute",
"datatype" : "String",
"description" : "CSM Global Registry URL",
"guid" : "5f49c658-e3fb-4ace-95aa-d5c13636a82e",
"hasValueObject" : [ {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttributeValue",
"attributeValue" : "localhost:7070",
"guid" : "79c5b890-1b4e-4514-8e28-ddd216551b3c",
"name" : "csm.global.url"
} ],
"isOptional" : false,
"isPassword" : false,
"length" : 255,
"modifiableWithoutRestart" : false,
"name" : "csm.global.url"
}, {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttribute",
"datatype" : "Integer",
"description" : "CSM Local Port",
"guid" : "9ceda25b-b408-4f38-bf78-26fc8a941ced",
"hasValueObject" : [ {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttributeValue",
"attributeValue" : "7070",
"guid" : "de64d5ff-ff11-4e2d-Make sure to save the cloudservices.json file.
Set the value parameter in the ..\Platform_Manager\configuration\PreferenceGroup.json file to http and 7070.
{
"cloudClass": "com.bmc.cloud.model.beans.PreferenceGroupNameValuePair",
"guid": "98d27d82-44fc-41c8-bde0-007f0fa8fc2f",
"name": "clmui base URL",
"value": "http://clm-aus-005121/clmui"
},{- Stop the CSM service and then perform the following actions:
- Back up the cache and data folders in .\Platform_Manager.
- Back up the org.eclipse.* folders in .\Platform_Manager\configuration.
- Delete the cache, data, and org.eclipse.* folders.
- Update the Platform Manager Root URL in the CMF:PluginConfiguration form on the Cloud Portal and Database AR System server to http and 7070.
- Start the CSM service.
- Restart the Cloud Portal and Database AR System service.
- Use RESTClient to verify the Platform Manager SSL connection by using the SSL link.
To configure Platform Manager from HTTP to HTTPS with a Self-Signed Certificate
To modify the Platform Manager integration with SSL
The following procedure applies if you are running multiple IT Service Management servers.
- In Cloud Portal and Database ITSM, open the CMF:PluginConfiguration form and change the Root URL from http to https and update the SSL port to 9443.
- In both ITSM hosts, import the RootCA certificate.
- Copy the RootCA.crt certificate to both hosts in its own folder (for example, C:\Certificates).
Import the certificate by entering following command.
C:\Program Files\Java\jre7\bin>keytool -import -alias root -keystore "C:\Program Files\Java\jre7\lib\security\cacerts" -trustcacerts -file C:\Certificates\RootCA.crt
Enter keystore password:
Owner: EMAILADDRESS=jstamps@bmc.com, CN=bmc.com, OU=IDD, O=BMC, L=San Jose, ST=C
A, C=US
Issuer: EMAILADDRESS=jstamps@bmc.com, CN=bmc.com, OU=IDD, O=BMC, L=San Jose, ST=
CA, C=US
Serial number: 802aae2101b14487
Valid from: Thu Apr 10 13:52:46 PDT 2014 until: Fri Apr 10 13:52:46 PDT 2015
Certificate fingerprints:
MD5: 15:4C:BE:02:B4:1D:6D:05:12:78:62:14:41:A5:AD:DA
SHA1: DE:B4:DF:5D:4E:58:B2:0B:EB:37:D7:57:F9:71:13:6B:CE:A5:05:B9
SHA256: A5:AC:79:D0:E3:21:BA:88:E7:78:77:CD:E8:18:88:14:96:CC:64:64:FD:
D6:12:76:CE:BF:70:BB:28:82:30:D9
Signature algorithm name: SHA1withRSA
Version: 3
Extensions:
#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 33 28 60 0A C6 83 16 47 D9 E2 4A D7 6B F9 DC 76 3(`....G..J.k..v
0010: 0D 6C 58 51 .lXQ
]
]
#2: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 33 28 60 0A C6 83 16 47 D9 E2 4A D7 6B F9 DC 76 3(`....G..J.k..v
0010: 0D 6C 58 51 .lXQ
]
]
#3: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
CA:true
PathLen:2147483647
]
Trust this certificate? [no]: yes
Certificate was added to keystoreYou do not need to import RootCA into the C:\ProgramFile\Java\Jre\bin path.
- Restart the Platform Manager and AR System servers.
- Verify your changes by putting the RESTClient on the ITSM host and connecting to the Platform Manager host with SSL URL and the trustcacerts path of Cloud Java (as above).
To configure BMC Capacity Optimization with SSL
This is a two-step process:
- Generating a certificate and key to use with Apache
- Enabling Apache to use HTTPS for BMC Capacity Optimization
To generate a certificate and key to use with Apache
- Install the following packages on the host if they are not already present.
- crypto-utils
- mod_ssl
- After installing these packages, generate a new key and a new SSL certificate using the genkey $hostname command.
Here $hostname is the fully qualified domain name of your BMC Capacity Optimization application server machine. To create a certificate request, select the appropriate option.
Enter the certificate fields with your information (Name, Firm, Country, and so on). If you do not want to manually insert a password every time you restart the Apache Httpd server (forexample, if you are in an automatic HA environment), clear the encrypt key option.
During key generation, review the following output on the console:
[root@clm-bco ~]# genkey csm-bco
/usr/bin/keyutil -c genreq -g 2048 -s "CN=csm-bco, OU=CDL, O=BMC, L=PUN, ST=MAHA, C=IN" -v 24 -a -o /etc/pki/tls/certs/csm-bco.0.csr -k /etc/pki/tls/private/csm-bco.key -z /etc/pki/tls/.rand.24660
cmdstr: genreq
cmd_CertReq
command: genreq
keysize = 2048 bits
subject = CN=csm-bco, OU=CDL, O=BMC, L=PUN, ST=MAHA, C=IN
valid for 24 months
output will be written to /etc/pki/tls/certs/csm-bco.0.csr
output key written to /etc/pki/tls/private/csm-bco.key
random seed from /etc/pki/tls/.rand.24660
Generating key. This may take a few moments...
Made a key
Opened /etc/pki/tls/certs/csm-bco.0.csr for writing
Wrote the CSR to /etc/pki/tls/certs/csm-bco.0.csr
Wrote 882 bytes of encoded data to /etc/pki/tls/private/csm-bco.key
Wrote the key to:
/etc/pki/tls/private/csm-bco.key
/usr/bin/keyutil -c makecert -g 2048 -s "CN=csm-bco, OU=CDL, O=BMC, L=PUN, ST=MAHA, C=IN" -v 1 -a -z /etc/pki/tls/.rand.24660 -o /etc/pki/tls/certs/csm-bco.crt -k /etc/pki/tls/private/csm-bco.key
cmdstr: makecert
cmd_CreateNewCert
command: makecert
keysize = 2048 bits
subject = CN=csm-bco, OU=CDL, O=BMC, L=PUN, ST=MAHA, C=IN
valid for 1 months
random seed from /etc/pki/tls/.rand.24660
output will be written to /etc/pki/tls/certs/csm-bco.crt
output key written to /etc/pki/tls/private/csm-bco.keyThe Certificate Signing Request (csm-bco.0.csr) file is generated at the /etc/pki/tls/certs location.
- Copy the csm-bco-0.csr file where you have CA or generate the CA certificate.
Or send this csr file to CA to get certificate. On the OpenSSL host, generate the certifcate, using the csm-bco-0.csr file.
C:\OpenSSL-Win64\bin>openssl x509 -req -days 365 -in C:\CSR\csm-bco.0.csr -CA C:\Certificates\RootCA.crt -CAkey C:\Keys\RootCA.key -set_serial 878 -out C:\Certificates\csm-bco.crt
Loading 'screen' into random state - done
Signature ok
subject=/C=IN/ST=MAHA/L=PUN/O=BMC/OU=CDL/CN=csm-bco
Getting CA Private Key- When you finish generating the key, you have the following results:
- $hostname.crt certificate file in /etc/pki/tls/certs/
- $hostname.key key file in /etc/pki/tls/private/
- Create /pki/tls/certs and /pki/tls/private folders at $CPITBASE/3rd_party/apache2/etc.
- Copy /etc/pki/tls/certs/$hostname.crt to $CPITBASE/3rd_party/apache2/etc/pki/tls/certs/<hostname>.cert.
- Copy /etc/pki/tls/private/$hostname.key to $CPITBASE/3rd_party/apache2/etc/pki/tls/ private/<hostname>.key.
- Change the owner of both the copied files and the created folders to the owner using BMC Capacity Optimization.
To enable HTTPS in Apache
To enable HTTPS in your BMC Capacity Optimization installation, perform the following steps:
Modify the caplan.conf configuration file located at $CPITBASE/3rd_party/apache2/etc/httpd/conf.d, by adding the following information:
SSLEngine on
SSLProxyEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
SSLCertificateFile $CPITBASE/3rd_party/apache2/etc/pki/tls/certs/<hostname>.crt
SSLCertificateKeyFile $CPITBASE/3rd_party/apache2 /etc/pki/tls/private/<hostname>.keyCreate the ssl.conf file in $CPITBASE/3rd_party/apache2/etc/httpd/conf.d and add the following content.
LoadModule ssl_module modules/mod_ssl.so
Listen 8443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLPassPhraseDialog builtin
SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout 300
SSLMutex default
SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin
SSLCryptoDevice builtinMake sure that you change the required SSL port.
- Restart Httpd using the $CPITBASE/cpit restart httpd command.
The new URL to connect to BCO will be https://$hostname:8443/console. Import the certificate into /gfs/cpit/jre/lib/security/cacerts for the trusted CA certificate.
[root@clm-bco bin]# ./keytool -import -alias root -keystore /gfs/cpit/jre/lib/security/cacerts -trustcacerts -file /etc/pki/tls/certs/RootCA.crt
Enter keystore password:
Owner: EMAILADDRESS=clm.bmc.com, CN=CLM, OU=CDL, O=BMC, L=PUN, ST=MAHA, C=IN
Issuer: EMAILADDRESS=clm.bmc.com, CN=CLM, OU=CDL, O=BMC, L=PUN, ST=MAHA, C=IN
Serial number: bfae9d478d3085c1
Valid from: Fri Apr 26 14:32:23 IST 2013 until: Sat Apr 26 14:32:23 IST 2014
Certificate fingerprints:
MD5: E7:87:3D:B3:33:82:9F:17:0B:F6:78:D1:0D:64:EB:F5
SHA1: 47:85:B7:4E:46:C4:8F:21:31:29:86:47:C5:7A:3C:7F:65:B6:36:27
Signature algorithm name: SHA1withRSA
Version: 1
Trust this certificate? [no]: yes
Certificate was added to keystore- When you access the BCO URL, review the following certificate:
To integrate BMC Capacity Optimization and Platform Manager changes into SSL
To configure BMC Atrium Orchestrator with SSL
A HA environment typically has the following components installed.
- Host A Primary: AMREPO (Access Manager and Repository) and CDP installed
- Host B Secondary: AMREPO and HACDP installed
- Host C: SQL DB for AMREPO
In non-HA environments, BMC Atrium Orchestrator Access Manager and Repository are installed on a single server. For example, see To install Atrium Orchestrator AMREPO in Installing-Small-Deployment-Windows-for-version-4-7.
- On the main AO hosts (for example, Host A and B), create Keys, Certificates, and CSR folders.
- Stop the Access Manager and Repository service and the Configuration Distribution Peer (CDP) service.
- Open a command prompt and navigate to the AMREPO JRE folder (for example, C:\Program Files\BMC Software\AO-Platform\AMREPO\jvm\bin).
On primary Host A, create a keypair using the keytool utility.
If Atrium Orchestrator is behind a load balancer, use CN as the load balancer name.
At the prompts, enter the required information to create the keypair, and then press Enter.keytool.exe -genkey -alias AO -keyalg RSA -keysize 2048
-keypass "changeit" -storepass "changeit"
-keystore C:\Keys\keystore.jks
What is your first and last name?
[Unknown]: vw-aus-clmidd04.bmc.com
What is the name of your organizational unit?
[Unknown]: IDD
What is the name of your organization?
[Unknown]: BMC Software
What is the name of your City or Locality?
[Unknown]: SAN JOSE
What is the name of your State or Province?
[Unknown]: California
What is the two-letter country code for this unit?
[Unknown]: US
Is CN=vw-aus-clmidd04.bmc.com, OU=IDD, O=BMC, L=SAN JOSE, ST=California, C=US correct?
[no]: yesCreate the Certificate Signing Request (ao.csr) from AO primary to retrieve the certificate from CA (i.e. CLM).
At the prompt, enter changeit as the password.
keytool.exe -certreq -keyalg RSA -alias AO
-file C:\CSR\ao.csr -keystore C:\Keys\keystore.jks
Enter keystore password:Copy the ao.csr file to the CSR folder where OpenSSL is installed so that you can generate a certificate, and then run the following command on the OpenSSL computer:
C:\OpenSSL-Win64\bin>openssl x509 -req -days 365
-in "C:\CSR\ao.csr" -CA "C:\Certificates\RootCA.crt"
-CAkey "C:\Keys\RootCA.key" -set_serial 999 -out "C:\Certificates\ao.crt"
Loading 'screen' into random state - done
Signature ok
subject=/C=US/ST=California/L=SAN JOSE/O=BMC Software/OU=IDD/CN=vw-aus-clmidd04.bmc.com
Getting CA Private Key- After the certificate is generated (ao.crt) in the Certificates folder, copy ao.crt and RootCA.crt and paste them to the AO primary and AO secondary into their Certificates folder.
To configure AMREPO to work with SSL
On the AO primary and AO secondary hosts, import the Root CA certificate.
At the prompt, enter changeit as the password. When you see the Trust this certificate prompt, enter yes. Your certificate is added to the keystore.keytool.exe -import -alias root -keystore C:\Keys\keystore.jks
-trustcacerts -file C:\Certificates\RootCA.crt
Enter keystore password:
Owner: EMAILADDRESS=jstamps@bmc.com, CN=vw-aus-clmidd05.bmc.com,
OU=IDD, O=BMC Software, L=San Jose, ST=California, C=US
...
Trust this certificate? [no]: yes
Certificate was added to keystoreImport the ao.crt certificate into the AO JVM security folder.
At the prompt, enter changeit as the password.
Your certificate reply is installed in the keystore.keytool.exe -import -alias root
-keystore "C:\Program Files\BMC Software\AO-Platform\AMREPO\
jvm\jre\lib\security\cacerts" -trustcacerts
-file C:\Certificates\RootCA.crt
Enter keystore password:
Owner: EMAILADDRESS=jstamps@bmc.com, CN=vw-aus-clmidd05.bmc.com,
OU=IDD, O=BMC Software, L=San Jose, ST=California, C=US
...
Trust this certificate? [no]: yes
Certificate was added to keystoreImport the ao.crt certificate into keystore.jks (for example, C:\Keys\keystore.jks):
keytool.exe -import -alias AO -keystore C:\Keys\keystore.jks
-trustcacerts -file C:\Certificates\ao.crt
Enter keystore password:
Certificate reply was installed in keystore- Open the Access Manager server.xml file (in Windows, for example, C:\Program Files\BMC Software\AO-Platform\AMREPO\tomcat\conf\server.xml) in a text editor and uncomment the SSL related sections.
Search for the following text and uncomment out the Connector port section:
<!-- Define a SSL HTTP/1.1 Connector on port 8443
This connector uses the JSSE configuration, when using APR, the
connector should be using the OpenSSL style configuration
described in the APR documentation -->
<!--
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
-->Modify the Connector port information as follows.
Uncomment the following section and change the protocol from HTTP/1.1 to org.apache.coyote.http11.Http11Protocol, and add the keystoreFile path for keystore.jks.
Make sure that you save the file.<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
ciphers="TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521, TLS_RSA_WITH_NULL_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA"
keystoreFile="C:\Keys\keystore.jks"
/>
Update the Login page entry in the context.xml file (for example, C:\Program Files\BMC Software\AO-Platform\AMREPO\tomcat\conf\context.xml) as follows:
<Environment name="com.bmc.security.am.LOGIN_PAGE"
override="true" type="java.lang.String"
value="https://clm-hou-007778:8443/baoam/login.jsf"/>- Start the AMREPO server and verify the Access Manager URL.
For example:
https://AMPrimaryHost:8443/baoam - Add and confirm any security restrictions in your browser.
For example, the certificate should display Issued by: bmc.com and Issued to: vw-aus-clmidd04. - Verify the Repository Manager URL and certificates.
For example:
https://AMPrimaryHost:8443/baorepo - Make the same changes to the secondary AMREPO server.
- Copy the keystore file.
- Update the server.xml and context.xml files.
- Import the Root CA certificate.
- Start the secondary Access Manager server.
- Verify the URL.
To configure primary and secondary CDP to work with SSL
Modify the server.xml file (for example, C:\Program Files\BMC Software\AO-Platform\CDP\tomcat\conf\server.xml) as follows.
Uncomment the following section and update the required port (for example, 9443), change the protocol from HTTP/1.1 to org.apache.coyote.http11.Http11Protocol, and add the keystoreFile path for keystore.<Connector port="9443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
ciphers="TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521, TLS_RSA_WITH_NULL_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA"
keystoreFile="C:\Keys\keystore.jks"
/>Modify the context.xml file (for example, C:\Program Files\BMC Software\AO\AM\CDP\tomcat\conf\context.xml) in a text editor.
Update the following entry with https.<Parameter name="com.bmc.ao.REPOSITORY_URL" override="true"
value="https://vw-aus-clmidd04:9443/baorepo/http"/>- Change directories to the primary CDP JRE/bin folder, for example, C:\Program Files\BMC Software\AO-Platform\CDP\jvm\jre\bin.
Import the ROOTCA.crt certificate into the primary CDP JVM security folder.
At the prompt, enter changeit as the password.
Your certificate reply is installed in the keystore.keytool.exe -import -alias root
-keystore "C:\Program Files\BMC Software\AO-Platform\CDP\
jvm\jre\lib\security\cacerts"
-trustcacerts
-file C:\certificates\RootCA.crt
Enter keystore password:
Owner: EMAILADDRESS=jstamps@bmc.com, CN=JOHN,
OU=IDD, O=BMC, L=SJ, ST=CA, C=US
Issuer: EMAILADDRESS=jstamps@bmc.com, CN=JOHN,
OU=IDD, O=BMC, L=SJ, ST=CA, C=US
...
Trust this certificate? [no]: yes
Certificate was added to keystore- Import the ROOTCA.crt certificate into the secondary CDP JVM security folder.
On the secondary CDP host, modify the context.xml file (for example, C:\Program Files\BMC Software\AO\AM\CDP\tomcat\conf\context.xml) in a text editor.
Update the following entries with corrected port and https.Parameter name="com.bmc.ao.HACDP_CONFIGURATION" override="true"
value="https://admin:admin123@vw-hou-sln-qa18:9443/
baocdp/ws/install?grid=GRID1&peer=HACDP"/>
<Environment name="grid-name" override="true"
type="java.lang.String" value="GRID1"/>
<Environment name="peer-endpoint-urls" override="true"
type="java.lang.String" value="https://vw-hou-sln-qa18:9443/
baocdp/ws/console"/>- Start the CDP server on both nodes and verify the URL.
For example:
https://<CDPHost>:9443/baocdp
- Add and confirm any security restrictions in your browser.
The certificate should display Issued by: bmc.com and Issued to: vw-aus-clmidd04. - Access the BMC Server Automation application server from Atrium Orchestrator hosts,
When you access the BMC Server Automation application server from Atrium Orchestrator hosts, it should display the following certificate details.
To configure BMC Server Automation and Atrium Orchestrator with SSL
You already generated the keystore.jks file in C:\Keys\keystore.jks and the RootCA.crt file in C:\Certificates on both hosts.
Import the RootCA.crt certificate into the Bladelogic java security file on both nodes as follows:
keytool.exe -import -alias root
-keystore "C:\Program Files\BMC Software\BladeLogic\NSH\jre\
lib\security\cacerts" -trustcacerts -file C:\Certificates\RootCA.crt- Log into the BMC Server Automation server from both hosts with defaultProfile and verify the certificate obtained.
To configure Atrium Orchestrator and Platform Manager with SSL
On the Platform Manager server, update the provider.json file for AO details like https and ports number wherever required.
For example:[{
"cloudClass" : "com.bmc.cloud.model.beans.Provider",
"accessValues" : [ {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttributeValue",
"accessAttribute" : {
"cloudClass" : "com.bmc.cloud.model.beans.AccessAttribute",
"datatype" : "STRING",
"guid" : "52461ff1-2ec4-11e0-91fa-0800200c9a66",
"isOptional" : false,
"isPassword" : false,
"modifiableWithoutRestart" : false,
"name" : "AO_SERVER_URL"
},
"attributeValue" : "https://clm-hou-007778:9443/baocdp/orca",
"guid" : "78274c00-9d52-4b7a-bd07-7e7bfa413855",
"name" : "AO_SERVER_URL"
}- Restart Platform Manager.
To configure Atrium Orchestrator and ITSM with SSL
- On the Cloud Portal and Database server, open the CMF PluginConfiguration form and update Atrium Orchestrator details like FIELD_AO_PROTOCOL, the FIELD_AO_PORT, and so on.
- Restart the AR System server.
To configure Cloud Portal Web Application from HTTP to HTTPS with a Self-Signed Certificate
Use the following steps to configure HTTP to HTTPS using a Self-Signed Certificate.
Generate a certificate.
For example:keytool -genkey -alias tomcat -keyalg RSA
-keystore "C:\clmuiSslCertificate.cert"
-dname "cn=vw-sjc-sln-qa32,ou=CLM,o=BMC,l=PUN,s=MH,c=IN"
-keypass "changeit" -storepass "changeit" -validity 36500- Copy the certificate to the required location.
For example:
C:\Program Files\BMC Software\CloudPortalWebApplication\clmui\Certificates\clmuiSslCertificate.cert - Update C:\Program Files\BMC Software\CloudPortalWebApplication\tomcat\conf\server.xml.
Replace the Connector entry:
<Connector connectionTimeout="20000" port="9070"
protocol="HTTP/1.1" redirectPort="9443"/>With the following information:
<Connector SSLEnabled="true" clientAuth="false" connectionTimeout="20000"
keystoreFile="C:\Program Files\BMC Software\CloudPortalWebApplication\
clmui\Certificates\clmuiSslCertificate.cert" keystorePass="changeit"
maxThreads="150" port="9443" scheme="https" secure="true" sslProtocol="TLS"/>
- Restart Cloud Portal Web Application service.
To configure Cloud Portal Web Application from HTTPS to HTTP with a Self-Signed Certificate
Use the following steps to configure HTTPS to HTTP using a Self-Signed Certificate.
- Update C:\Program Files\BMC Software\CloudPortalWebApplication\tomcat\conf\server.xml.
Replace the Connector entry:
<Connector SSLEnabled="true" clientAuth="false"
connectionTimeout="20000" keystoreFile="C:\Program Files\BMC Software\
CloudPortalWebApplication\clmui\Certificates\clmuiSslCertificate.cert"
keystorePass="changeit" maxThreads="150" port="9443" scheme="https"
secure="true" sslProtocol="TLS"/>With the following information:
<Connector connectionTimeout="20000" port="9070"
protocol="HTTP/1.1" redirectPort="9443"/>
- Restart Cloud Portal Web Application service.
To configure CLM Self-Checker from HTTP to HTTPS with a Self-Signed Certificate
Use the following steps to configure HTTP to HTTPS using a Self-Signed Certificate.
Generate a certificate.
For example:C:\Program Files\Java\jre1.7.0_55\bin>keytool -genkey
-alias tomcat -keyalg RSA
-keystore "C:\ selfcheckerSslCertificate.cert"
-dname "cn=vw-sjc-sln-qa32,ou=CLM,o=BMC,l=PUN,s=MH,c=IN"
-keypass "changeit" -storepass "changeit" -validity 36500- Copy the certificate to the required location.
For example:
C:\Program Files\BMC Software\SelfChecker\selfchecker\Certificates\selfcheckerSslCertificate.cert - Update C:\Program Files\BMC Software\SelfChecker\tomcat\conf\server.xml .
Replace the Connector entry:
<Connector connectionTimeout="20000" port="8090"
protocol="HTTP/1.1" redirectPort="8443"/>With the following information:
<Connector SSLEnabled="true" clientAuth="false"
connectionTimeout="20000"
keystoreFile=" C:\Program Files\BMC Software\SelfChecker\selfchecker\
Certificates\selfcheckerSslCertificate.cert" keystorePass="changeit"
maxThreads="150" port="8443" scheme="https" secure="true" sslProtocol="TLS"/>
- Restart the Self Checker service.
To configure CLM Self-Checker from HTTPS to HTTP with a Self-Signed Certificate
Use the following steps to configure HTTPS to HTTP using a Self-Signed Certificate.
- Update C:\Program Files\BMC Software\SelfChecker\tomcat\conf\server.xml.
Replace the Connector entry:
<Connector SSLEnabled="true" clientAuth="false" connectionTimeout="20000"
keystoreFile="C:\Program Files\BMC Software\SelfChecker\
selfchecker\Certificates\selfcheckerSslCertificate.cert"
keystorePass="changeit" maxThreads="150" port="8443"
scheme="https" secure="true" sslProtocol="TLS"/>With the following information:
<Connector connectionTimeout="20000" port="8090"
protocol="HTTP/1.1" redirectPort="8443"/>
- Restart the Self Checker service.
To configure BMC MyIT from HTTP to HTTPS with a Self-Signed Certificate
Generate a certificate.
For example:%JAVA_HOME%\bin\keytool -genkey -alias tomcat -keyalg RSA
Enter keystore password:
Re-enter new password:
What is your first and last name?
[Unknown]: clm-aus-011540,bmc.com
What is the name of your organizational unit?
[Unknown]: IDD
What is the name of your organization?
[Unknown]: BMC Software
What is the name of your City or Locality?
[Unknown]: San Jose
What is the name of your State or Province?
[Unknown]: California
What is the two-letter country code for this unit?
[Unknown]: US
Is CN="clm-aus-011540,bmc.com", OU=IDD, O=BMC Software, L=San Jose, ST=Californi
a, C=US correct?
[no]: yes
Enter key password for <tomcat>
(RETURN if same as keystore password):A .keystore file is generated in %USERPROFILE% (Windows) or $HOME (Linux), and the file is protected with a password.
- Place the generated file in the CATALINA_BASE/external-conf folder (for example, C:\Program Files\Apache Software Foundation\Tomcat8.0\external-conf).
Update CATALINA_BASE/conf/server.xml to enable HTTPS Connector.
Uncomment the following section, and update the section as follows (for example, add the keystoreFile path for keystore), and so on.
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
ciphers="TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521, TLS_RSA_WITH_NULL_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA"
keystoreFile="${catalina.base}/external-conf/.keystore"
sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1,SSLv2Hello"- Restart the Tomcat server (SmartIT/MyIT Application).
- To check the configuration, open https://localhost:8443/ or https://localhost:8443/ux/myitapp in a browser.
Upon initial access, a warning about an non-trusted certificate appears (because this is a self-signed certificate, not generated by a trusted CA). - Click OK to continue.
You should successfully be logged on to the MyIT application using SSL.
Related topic
Using-CLM-applications-with-third-party-Certification-Authority-certificates