Troubleshooting certificates

How to generate 2K size certificates

You must perform the following steps to generate 2k size certificates:

1. Delete the existing alias entry from keystore:

   keytool -delete -alias tomcat -keystore keystore.p12 -storepass 
   internal4bmc -storetype PKCS12 -providername JsafeJCE

2. Generate the 2K size certificate:

   keytool -genkeypair -keyalg RSA -alias tomcat -keystore 
   keystore.p12 -keysize 2048 -storepass internal4bmc -storetype 
   PKCS12 -providername JsafeJCE

3. When prompted for first and last names, enter the fully qualified domain name (FQDN) of the BMC Atrium Single Sign-On Server.

4. Export the certificate:

   keytool -exportcert -keyalg RSA -alias tomcat -keystore 
   keystore.p12 -storepass internal4bmc -storetype PKCS12 -providername 
   JsafeJCE -v -file sso2k.csr

5. Get the certificate signed by the security authority and rename the signed certificate to:
   "sso2ksigned.csr"

6. Import the signed certificate:

   keytool -importcert -keyalg RSA -alias tomcat -keystore 
   keystore.p12 -storepass internal4bmc -storetype PKCS12 -providername 
   JsafeJCE -file sso2ksigned.csr

Certificate installation on secondary nodes

Keystore certificates are replicated on secondary nodes as soon as you save the changes in the first node's certificate panel. If any of the cluster nodes are down or not available, the certificate must be copied manually to those nodes.