You might need to update the service provider certificate if it has expired. This topic describes how to update the certificate on a single Remedy SSO server, and how to update the certificate if you have Remedy SSO deployed in an HA cluster.

To update the SP certificate on Remedy SSO server 

To update Remedy SSOservice provider (SP) certificate, perform the following tasks:

1. Update the java keystore cot.jks file
2. Update the signing certificate in Remedy SSO Admin console

3. Update the SP metadata at the IdP side

   Note

   The paths specified in the following steps are for Windows OS. You need to find out the corresponding path in the Linux OS.

   The file name for the java keystore should be cot.jks.
   

To update the java keystore cot.jks file

Perform the following steps on the system where Remedy SSO server is installed.

1. Go to the <tomcat>\rsso\WEB-INF\classes directory.
2. Locate the cot.jks file and take a backup of the file.

3. Run the keytool command to delete the alias ‘sp-signing’ from the existing cot.jks file.
   keytool -delete -alias test2 -keystore cot.jks

4. Create a new keypair with alias ‘test2’ in the existing cot.jks file.
   keytool -keystore cot.jks -genkey -alias test2 -keyalg RSA -sigalg SHA256withRSA -keysize 2048 -validity 730

5. Export ‘test2’ certificate in the PEM format.
   keytool -export -keystore cot.jks -alias test2 -file test2.pem –rfc
The system creates a test2.pem file.

6. Take a backup of the updated cot.jks file.

If you have other Remedy SSO server instances in the same cluster, replace the cot.jks file in the <tomcat>\rsso\WEB-INF\classes folder with the updated cot.jks file.

To update the signing certificate in Remedy SSO Admin Console

1. Log in to Remedy SSO Admin Console.
2. Go to General > Advanced tab.
3. Enter the following details:
   
   • Keystore File
   • Keystore Password
   • Signing Key Alias
4. Click Save.
5. Wait for 15 seconds, view the realm using SAML.
6. On the Authentication tab, click View Metadata. Verify the SP metadata is updated with the new signing certificate.

To update the SP metadata at the IdP side

1. Export the SP metadata and save it in a local file.
2. Share the exported SP metadata and the new signing certificate information with the IdP team for updating.

If ADFS is the IdP, add the new signing certificate:

1. Open Properties dialog of the relying party for Remedy SSO.
2. Go to the Signature tab.
3. Click Add.
4. Select the new signing certificate file.
5. Click OK.

To update the SP certificate in an HA environment

To achieve a zero-down time in a cluster environment for the signing certificate update when Active Directory Federated (ADFS) Services is the IdP, perform the following steps:

1. Put down one Remedy SSO server instance and update the java keystore cot.jks file on it.
2. Update the signing certificate in Remedy SSO Admin Console.
3. Update the SP metadata at the IdP side. Note that you must not delete the old signing certificate.
4. Make Remedy SSO server instance up again.
5. Repeat step 1 to step 4 for all Remedy SSO server instances.
6. After the keystore cot.jks is updated on all Remedy SSO server instances, remove the old signing certificate on Remedy SSO relying party at ADFS side.