This documentation supports the 19.02 version of Remedy with Smart IT.

To view the latest version, select the version from the Product version menu.

Enabling SSL for Openfire chat server

Complete the following steps to enable a secure sockets layer (SSL) for the Openfire chat server that runs with Smart IT.

To configure SSL for Openfire

  1. Obtain a valid, signed certificate from a trusted certificate authority (CA). The certificate can be in any format, such as .pem, .cer, or .crt.
  2. Import the certificate provided by the CA. Do these steps for all Openfire nodes, if installed in a cluster.
    1. Import the signed root certificate and private key to the Openfire keystore, located by default in <Openfire_installation_directory>/resources/security/keystore.
    2. Import the Smart IT server certificate to the Openfire truststore, located by default in <Openfire_installation_directory>/resources/security/truststore. Also import the Smart IT certificate to the client.truststore, if available (<Openfire_installation_directory>/resources/security/client.truststore).


      If Openfire is installed on the same server as Smart IT, the keystore and truststore are located under the Smart IT installation folder.

      If you have specified a truststore file in the Apache server.xml file, you must import the root and intermediate certificates there.


      You can use one of the following methods to import the certificate:

        • (Recommended) By using a keytool, such as KeyStore Explorer:
          a. Download and install KeyStore Explorer from
          b. Choose Tools > Import Trust Certificate to import the certificate to the keystore and truststore.
        • By using the OpenSSL command line:
          Example (keystore import): <JAVA_HOME>\bin\keytool -import -keystore keystore -alias -file signed_certificate_file
          Example (trustore import): <JAVA_HOME>\bin\keytool -import -keystore truststore -alias user_name -file certificate_file

          Note: Make sure that the alias does not already have an associated key, or you will receive an error.
  3. Import the the Openfire root certificate to the installed JRE location used by Smart IT for the mutual handshake: <JRE_installation_directory>/lib/security/cacerts.


    This should be the same JRE that Apache Tomcat uses.
  4. Change the following statements from the Centralized Configuration (CCS). = <Fully qualified domain name (FQDN)>
    chat.server.client.port = 5222
    chat.server.admin.login = 
    chat.server.admin.password = 
    chat.server.groupChatService = conference
    chat.server.admin.pool.size = 6
    chat.server.boshUrl = https://<Fully qualified domain name (FQDN)>:<port>/http-bind/
    chat.server.domain = <Fully qualified domain name (FQDN)>

    Example: =
    chat.server.client.port = 5222
    chat.server.admin.login = admin
    chat.server.admin.password = fdNSxb1XU5a%2F184s3OkhcA%3D%3D
    chat.server.groupChatService = conference
    chat.server.admin.pool.size = 6
    chat.server.boshUrl =
    chat.server.domain =


    To locate the port number for chat.server.boshUrl, from the Openfire Admin Console, go to Server > Server Settings > HTTP Binding:

  5. From the Openfire Admin Console, go to Server > Server Manager > System Properties.
  6. Change the provider.auth.authResource property to https://<Smart_IT_host>:<Smart_IT_port>/smartit/rest/users/chat/.
  7. Restart the Openfire service.
    If the Openfire or SSL services do not start, look for errors in the Openfire logs to confirm that the certificate imports were correct.
  8. Restart the Smart IT service.
Was this page helpful? Yes No Submitting... Thank you