This documentation supports the 19.02 version of BMC Digital Workplace Advanced.

To view an earlier version, select the version from the Product Version menu.

Configuring SSL for the Tomcat server

To provide communication security among applications, configure SSL for the Apache Tomcat server. If you enabled SSL as part of installation, SSL is already configured. Otherwise, follow this procedure.

Best Practice

To protect data, use HTTPS to communicate with the BMC Digital Workplace server. You can do so either through a load balancer or reverse proxy, or by enabling HTTPS on the BMC Digital Workplace server.

Before you begin

Performing the BMC Digital Workplace installation.

Video demonstration: Configuring SSL for BMC Digital Workplace


Note

The following video shows an older version of BMC Digital Workplace. The previous product name was MyIT. Although there might be minor changes in the user interface, the overall functionality remains the same.

https://youtu.be/N3vkIBqzKuE

To configure SSL for the Tomcat server

For more information about creating a certificate, see  http://tomcat.apache.org/tomcat-8.0-doc/ssl-howto.html .

Note

The self-signed certificate works only with the universal client. For mobile apps, you must use a signed certificate from a trusted Certificate Authority.

  1. Generate a self-signed certificate by running the following command:
    %JAVA_HOME%\bin\keytool -genkey -alias tomcat -keyalg RSA -keystore \path\to\my\keystore
    A .keystore file is generated in %USERPROFILE% (Windows) or $HOME (Linux), and the file is protected with a password.
  2. Place the generated file in the CATALINA_BASE/external-conf folder.
  3. Update CATALINA_BASE/conf/server.xml to enable HTTPS Connector:

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
                   maxThreads="150" scheme="https" secure="true"
                   keystoreFile="${catalina.base}/external-conf/.keystore" keystorePass="Bmcmyit1"
                   clientAuth="false" sslProtocol="TLS"
    			   sslEnabledProtocols="TLSv1.2,TLSv1.1,SSLv2Hello"/>

    A sample server.xml file can be found in the bsmapps\main\server\external\tomcat\conf folder. 

  4. Restart the Tomcat server.

  5. To check the configuration, open https://localhost:8443/dwp/rest/version in a browser.
    Upon initial access, a warning about an non-trusted certificate appears (because this is a self-signed certificate, not generated by a trusted CA).

  6. Click OK to continue.

To enable Strict-Transport-Security response header

To enable Strict-Transport-Security response header for BMC Digital Workplace to tell browsers that it should only be accessed using HTTPS, instead of using HTTP, uncomment the following code in DigitalWorkplace_Installation_Directory/dwp/WEB-INF/web.xml and restart BMC Digital Workplace:

 <init-param>
            <param-name>Strict-Transport-Security</param-name>
            <param-value>max-age=16070400</param-value>
 </init-param>


Where to go from here

Making configuration changes to integrated applications

Was this page helpful? Yes No Submitting... Thank you

Comments