Using CA-signed certificates for communication between peers

Secure Sockets Layer (SSL) is used to keep sensitive information sent across the Internet encrypted. A proper self-signed certificate provides authentication, which ensures that you are sending information to the right server and not to an unintended server. Customers most often send information through several computers. It is possible to avoid intermediate computers from pretending to be your website and trick your users into sending them personal information by using a proper Public Key Infrastructure (PKI), and getting an signed certificate from a trusted provider.

Perform the following tasks to use a CA-signed certificate:

1. Generate a CA-signed certificate.
2. Replace the SSL certificate with the CA-signed certificate.
3. Encrypt the keystore password.

Generate a CA-signed certificate

To generate a CA-signed certificate, perform the following steps:

1. To generate the keystore with signature algorithm SHA2, run the keytool command, as shown in the following example:

   keytool -genkeypair -alias tomcat -keyalg RSA -sigalg SHA256withRSA -keysize 2048 -storetype JKS -keystore Sample.keystore -validity 3650 -dname "CN=Sample.bmc.com,O=BMC Software Inc,OU=TSO,L=Houston,ST=Texas,C=US" -ext "SAN=IP:<IPAddress>,IP:<IPAddress>,DNS:*.bmc.com"

   You can modify the parameters in this command as per your requirements:

   Parameter	Description/Value
   alias	The key name in the keystore file.
   keystore	The name of the keystore file. In this command, the keystore file is Sample.keystore.
   CN	Common Name The Common Name must be provided by the requester and should be a fully qualified domain name (FQDN).
   O	Organization For example, BMC Software Inc.
   OU	Organizational Unit The Organizational Unit must be provided by the requester.
   L	Location For example, Houston.
   ST	State For example, Texas.
   C	Country For example, US
   SAN	Subject Alternative Name The SAN can be the IP addresses of the machine or the Common Name in FQDN format.
   DNS	Domain name of the organization. Ensure to have "*" before Domain Name. For example, *.bmc.com

2. Enter and confirm the valid keystore password, when prompted.
3. Enter and confirm the valid alias password when prompted.
   The Sample.keystore file is generated.
4. Run the following command to export certificate signing request (CSR) file:{{code language="none"}}
   
   
   {{/code}}keytool -certreq -file "C:\Data\TSO\CA Certificate\SampleCSR.csr" -keystore "C:\Data\TSO\CA Certificate\Sample.keystore" -alias tomcat -ext "SAN=IP:192.160.0.1,IP:192.160.0.2"
   
   

5. Enter and confirm the keystore password when prompted.

   A CSR file named SampleCSR.csr is generated at the location C:\Data\TSO\CA Certificate\SampleCSR.csr using the Sample.keystore file located at C:\Data\TSO\CA Certificate\Sample.keystore.

6. Submit the SampleCSR.csr file to the certification authority (CA) and get the CA-signed certificate.
7. Import the root CA certificate into the keystore, as follows:
   1. Run the following command:keytool.exe -importcert -keystore "C:\Data\TSO\CA Certificate\Sample.keystore" -alias tomcat -file "C:\Data\TSO\CA Certificate\Sample.p7b
   2. When prompted for the password, enter the keystore password.

The following sample messages are displayed, when you execute the above commands:

Replace the SSL certificate with the CA-signed certificate

When you install TrueSight Orchestration 22.2 for the first time or when you upgrade to version 22.2, the Self-signed certificate is the default authentication certificate for communication between peers. To use a CA-signed certificate, you need to replace the Self-signed certificate for all the peers.

Before you begin

Navigate to the <peer>/config directory for each peer (for example, BAOhome/CDP/config for CDP), and verify that the following files are present:

• The default file, certificate.keystore
• The jms-ssl-configuration containing the certificate path and default password

To replace the self-signed certificate with the CA-signed certificate, perform the following steps:

1. Stop the TrueSight Orchestration services.
2. Navigate to the <peer>/config directory and back up the default self-signed certificate.
3. Replace the certificate.keystore file with the CA-signed certificate.
4. Update the jms-ssl-configuration file with the certificate name and password.
5. Start the TrueSight Orchestration services.

Encrypt the keystore password

To encrypt the keystore password, perform the following steps:

1. Run the maintenance tool and encrypt the password by using the Encrypt Product Password option.
2. Navigate to the <peer>/config directory and change the encrypted value to yes in the jms-ssl-configuration file.
3. Restart the services

Related topics

Installing – Classic mode

Upgrading