This documentation supports the 18.08 version of Remedy with Smart IT.

To view the latest version, select the version from the Product version menu.

Enabling SSL for Openfire chat server

Complete the following steps to enable a secure sockets layer (SSL) for the Openfire chat server that runs with Smart IT.

To configure SSL for Openfire

  1. Obtain a valid, signed certificate from a trusted certificate authority (CA). The certificate can be in any format, such as .pem, .cer, or .crt.
  2. Import the certificate provided by the CA. Do these steps for all Openfire nodes, if installed in a cluster.
    1. Import the signed root certificate and private key to the Openfire keystore, located by default in <Openfire_installation_directory>/resources/security/keystore.
    2. Import the Smart IT server certificate to the Openfire truststore, located by default in <Openfire_installation_directory>/resources/security/truststore. Also import the Smart IT certificate to the client.truststore, if available (<Openfire_installation_directory>/resources/security/client.truststore).

      Notes

      If Openfire is installed on the same server as Smart IT, the keystore and truststore are located under the Smart IT installation folder.

      If you have specified a truststore file in the Apache server.xml file, you must import the root and intermediate certificates there.

      Tip

      You can use one of the following methods to import the certificate:

        • (Recommended) By using a keytool, such as KeyStore Explorer:
          a. Download and install KeyStore Explorer from http://www.keystore-explorer.org/downloads.php
          b. Choose Tools > Import Trust Certificate to import the certificate to the keystore and truststore.
        • By using the OpenSSL command line:
          Example (keystore import): <JAVA_HOME>\bin\keytool -import -keystore keystore -alias example.com -file signed_certificate_file
          Example (trustore import): <JAVA_HOME>\bin\keytool -import -keystore truststore -alias user_name -file certificate_file

          Note: Make sure that the alias does not already have an associated key, or you will receive an error.
  3. Import the the Openfire root certificate to the installed JRE location used by Smart IT for the mutual handshake: <JRE_installation_directory>/lib/security/cacerts.

    Note

    This should be the same JRE that Apache Tomcat uses.
  4. Change the following statements from the Centralized Configuration (CCS).

    chat.server.cm.host = <Fully qualified domain name (FQDN)>
    chat.server.client.port = 5222
    chat.server.admin.login = 
    chat.server.admin.password = 
    chat.server.groupChatService = conference
    chat.server.admin.pool.size = 6
    chat.server.boshUrl = https://<Fully qualified domain name (FQDN)>:<port>/http-bind/
    chat.server.domain = <Fully qualified domain name (FQDN)>

    Example:

    chat.server.cm.host = ofchat-vm.calbro.com
    chat.server.client.port = 5222
    chat.server.admin.login = admin
    chat.server.admin.password = fdNSxb1XU5a%2F184s3OkhcA%3D%3D
    chat.server.groupChatService = conference
    chat.server.admin.pool.size = 6
    chat.server.boshUrl = https://ofchat-vm.calbro.com:7443/http-bind/
    chat.server.domain = ofchat-vm.calbro.com

    Tip

    To locate the port number for chat.server.boshUrl, from the Openfire Admin Console, go to Server > Server Settings > HTTP Binding:

  5. From the Openfire Admin Console, go to Server > Server Manager > System Properties.
  6. Change the provider.auth.authResource property to https://<Smart_IT_host>:<Smart_IT_port>/smartit/rest/users/chat/.
    Example: https://smartit-vm2.calbro.com:8443/smartit/rest/users/chat/
  7. Restart the Openfire service.
    If the Openfire or SSL services do not start, look for errors in the Openfire logs to confirm that the certificate imports were correct.
  8. Restart the Smart IT service.
Was this page helpful? Yes No Submitting... Thank you

Comments

  1. Andreas Mitterdorfer

    The documentation in 2 b) is incorrect. Please refer to Case 00620901. You need to import the SmartIT certificate to Openfire's /lib/security/cacerts (resp. jssecacerts) file.

    Jan 21, 2019 11:04
    1. Nilay Agambagis

      Hello Andreas,

      Thanks for your comment. I have updated 2b point. Our QA team is checking the patch that you mentioned. I will get back to you on this.

      Regards,

      Nilay Agambagis

      Jan 22, 2019 02:42