Encrypting your database connection

TrueSight Server Automation – Data warehouse does not support using an encrypted Microsoft SQL Server database or Oracle database connection at the time of installation or upgrade. However, after the product is installed or upgraded successfully, TrueSight Server Automation – Data warehouse can use an encrypted connection to communicate with the Microsoft SQL Server database or Oracle database.

This topic describes the steps for encrypting your database connection to TrueSight Server Automation – Data warehouse:

• Enabling encryption in SQL Server database connection
• Enabling encryption in Oracle database connection

Enabling encryption in SQL Server database connection

Enabling encryption in a SQL Server database connection using third-party CA certificates

Depending on your company's policy, you can choose any third-party certificate authority (CA) to issue certificates for Server Authentication.

Step 1: Install certificate and configure the SQL Server to accept encrypted connections

Refer to the Microsoft documentation for the detailed steps on Enabling Encrypted Connections to the Microsoft SQL Server Database Engine.

Step 2: Configure the TrueSight Server Automation Data Warehouse server

Perform the following steps on all your TrueSight Server Automation Data Warehouse server to communicate with encrypted database:

1. Obtain the third-party CA certificate of Database Server and copy to the TrueSight Server Automation Data Warehouse server to a temporary location.
2. Navigate to the <TSSADW_install_dir>\shared\ConfigurationManagement and open the bds.properties file and change value of SSL_DATABASE_CONNECTION to true, and save the changes

3. From the command prompt navigate to <TSSADW_install_dir>\jre\bin and enter the following command to import the public key certificate file into the TrueSight Server Automation - Data Warehouse keystore.
   keytool -import -v -trustcacerts -alias <alias_name> -file <path_where_3rd_party_cert_is_copied> -keystore <tssadw_installation_directory>/jre/lib/security/cacerts 

   Example

   keytool -import -v -trustcacerts -alias tcpsdw -file "C:\temp\clm-pun-t0v35f.bmc.com.cer" -keystore "C:\Program Files\BMC Software\TSSA-DW\jre\lib\security\cacerts"

   Important

   In upgrade scenarios, you might not have to import the certificate, instead you must use the name as specified as the alias for importing the certificates in cacerts file.

4. When prompted for a password, enter the password that is set for JRE cacerts keystore in TrueSight Server Automation - Data Warehouse. The default password set for cacerts is typically changeit.
5. Restart the following services:
   1. TrueSight Server Automation - Data Warehouse Web Server
   2. BMC SARA Authentication 

Enabling encryption in Oracle database connection

Perform the following steps for encrypting the connection to your Oracle database.

Step 1: Configure Oracle database to accept encrypted connections

For detailed steps on enabling encryption on your Oracle database server, using Oracle Advanced Security, refer to the Oracle Database documentation.

Step 2: Configure the TrueSight Server Automation - Data Warehouse server

Perform the following steps on all your TrueSight Server Automation - Data Warehouse server to communicate with TCPS encrypted database:

1. Obtain the Database Server certificate and copy to the TrueSight Server Automation Data Warehouse server to a /tmp location.
2. Navigate to the <TSSADW_install_dir>/shared/ConfigurationManagement and open the bds.properties file.
3. Modify the following parameters and save the changes.
   1. SSL_DATABASE_CONNECTION=true
   2. BSA_DATABASE_PORT=<tcps_port>
   3. {{code language="none"}}
      BSA_SITEx_SOURCE_DATABASE_PORT=<tcps_port>
      
      {{/code}}

      Example

      1. SSL_DATABASE_CONNECTION=true
      2. BSA_DATABASE_PORT=1522
      3. BSA_SITEx_SOURCE_DATABASE_PORT=1522

4. From the command prompt navigate to <TSSADW_install_dir>/jre/bin and enter the following command to import the public key certificate file into the TrueSight Server Automation - Data Warehouse keystore:
   ./keytool -import -v -trustcacerts -alias <alias_name> -file <path_where_oracle_wallet_cert_is_copied> -keystore <tssadw_installation_directory>/jre/lib/security/cacerts
   

   Example

   ./keytool -import -v -trustcacerts -alias tcpsdw -file “/tmp/ExportedCertificateFromServer.cer" -keystore "/data1/bmc/TSSA-DW/jre/lib/security/cacerts"

   Important

   In upgrade scenarios, you might not have to import the certificate, instead you must use the name as specified as the alias for importing the certificates in cacerts file.

5. When prompted for a password, enter the password that is set for JRE cacerts keystore in TrueSight Server Automation - Data Warehouse. The default password set for cacerts is typically changeit.
6. Login as DWAdmin.
7. Go to Configuration > Database Details
8. Click Modify for TrueSight Server Automation - Data Warehouse connection.

9. Enter the password and save.

   Important

   This will update the global.properties file as per information provided in bds.properties file.  We should not modify property files manually where possible to avoid un-necessary typos.