This documentation supports the 1.5 version of Remedy with Smart IT.

To view the latest version, select the version from the Product version menu.

Enabling SSL for Openfire chat server

Complete the following steps to enable a secure sockets layer (SSL) for the Openfire chat server that runs with BMC Remedy with Smart IT (Smart IT).

To configure SSL for Openfire

  1. Obtain a valid, signed certificate from a trusted certificate authority (CA). The certificate can be in any format, such as .pem, .cer, or .crt.
  2. Import the certificate provided by the CA. Do these steps for all Openfire nodes, if installed in a cluster.
    1. Import the signed root certificate and private key to the Openfire keystore, located by default in <Openfire_installation_directory>/resources/security/keystore.
    2. Import the Smart IT server certificate to the Openfire truststore, located by default in <Openfire_installation_directory>/resources/security/truststore. Also import the Smart IT certificate to the client.truststore, if available (<Openfire_installation_directory>/resources/security/client.truststore). This step is required for the SSL handshake between Openfire and Smart IT that is used for mutual authentication.

      Notes

      If Openfire is installed on the same server as Smart IT, the keystore and truststore are located under the Smart IT installation folder.

      If you have specified a truststore file in the Apache server.xml file, you must import the root and intermediate certificates there.

      Tip

      You can use one of the following methods to import the certificate:

        • (Recommended) By using a keytool, such as KeyStore Explorer:
          a. Download and install KeyStore Explorer from http://www.keystore-explorer.org/downloads.php
          b. Choose Tools > Import Trust Certificate to import the certificate to the keystore and truststore.
        • By using the OpenSSL command line:
          Example (keystore import): <JAVA_HOME>\bin\keytool -import -keystore keystore -alias example.com -file signed_certificate_file
          Example (trustore import): <JAVA_HOME>\bin\keytool -import -keystore truststore -alias user_name -file certificate_file

          Note: Make sure that the alias does not already have an associated key, or you will receive an error.
  3. Import the the Openfire root certificate to the installed JRE location used by Smart IT for the mutual handshake: <JRE_installation_directory>/lib/security/cacerts.

    Note

    This should be the same JRE that Apache Tomcat uses.
  4. Change the following statements in the connect.properties file in Tomcat/external-conf/:

    chat.server.cm.host = <Fully qualified domain name (FQDN)>
    chat.server.client.port = 5222
    chat.server.admin.login = 
    chat.server.admin.password = 
    chat.server.groupChatService = conference
    chat.server.admin.pool.size = 6
    chat.server.boshUrl = https://<Fully qualified domain name (FQDN)>:<port>/http-bind/
    chat.server.domain = <Fully qualified domain name (FQDN)>

    Example:

    chat.server.cm.host = ofchat-vm.calbro.com
    chat.server.client.port = 5222
    chat.server.admin.login = admin
    chat.server.admin.password = fdNSxb1XU5a%2F184s3OkhcA%3D%3D
    chat.server.groupChatService = conference
    chat.server.admin.pool.size = 6
    chat.server.boshUrl = https://ofchat-vm.calbro.com:7443/http-bind/
    chat.server.domain = ofchat-vm.calbro.com

    Tip

    To locate the port number for chat.server.boshUrl, from the Openfire Admin Console, go to Server > Server Settings > HTTP Binding:

  5. From the Openfire Admin Console, go to Server > Server Manager > System Properties.
  6. Change the provider.auth.authResource property to https://<Smart_IT_host>:<Smart_IT_port>/ux/rest/users/chat/.
    Example: https://smartit-vm2.calbro.com:8443/ux/rest/users/chat/
  7. Restart the Openfire service.
    If the Openfire or SSL services do not start, look for errors in the Openfire logs to confirm that the certificate imports were correct.
  8. Restart the Smart IT service.

Related topics

Configuring SSL for the Tomcat server

This version of the documentation is no longer supported. However, the documentation is available for your convenience. You will not be able to leave comments.

Comments