Managing TLS security certificates

To import the security certificates into the Infrastructure Management Serverkeystore, and thetruststorefiles

1. Log on to the computer where the Infrastructure Management Server is installed. The keytoolutility that is used to import the certificates is present in the <Infrastructure Management Server Installation Directory>\pw\jre\bin directory. Add this directory path to the PATH environment variable by running the following command:

   #Microsoft Windows
   set PATH=<Infrastructure Management Server Installation Directory>\pw\jre\bin;%PATH%
   
   #Unix
   export PATH=<Infrastructure Management Server Installation Directory>/pw/jre/bin:$PATH
2. Navigate to the <Infrastructure Management Server Installation Directory>\pw\pronto\conf directory, and import the procured certificates by running the following commands:

   keytool -import -alias caserver -file ca.crt -keystore messagebroker.ts
    
   keytool -import -alias caserver -file ca.crt -keystore pnserver.ks
    
   keytool -importkeystore -deststorepass get2net -destkeypass get2net -destkeystore pnserver.ks -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass password

   Parameter descriptionThe following notes describe the key parameters used in the preceding commands:

   • ca.crt is the name of the CA signedcertificate. If the name of the CA signed certificate procured from your system administrator is different, use the relevant file name in the preceding command.
   • If you want to use self-signedcertificate instead of the CA signed certificate, see Creating self-signed certificates.
   • server.p12 is the name of the private key file which is in PKCS12 format. If the name of private key procured from your system administrator is different, use the relevant file name in the preceding command.
   • get2net is the default password for the pnserver.ks keystore. If you want to change this password, run the following command:

     keytool -storepasswd -keystore pnserver.ks

     Provide the complete path for the keystore file in the preceding command, if you are running this command outside of the keystore directory location.

   • password is the password for the server.p12 private key.

To import the security certificates into the Infrastructure Management Server truststore

The Infrastructure Management Server uses the messagebroker.ts truststore to cummunicate with the BMC Atrium Single Sign-On. This truststore is bundled along with the Infrastructure Management Server installation, and is located in the <Infrastructure Management Server Installation Directory>\pw\jre\lib\security directory. Perform the following steps to import the security certificates into this truststore:

1. Log on to the computer where the Infrastructure Management Server is installed. The keytool utility that is used to import the certificates is present in the <Infrastructure Management Server Installation Directory>\pw\jre\bin directory. Add this directory path to the PATH environment variable by running the following command:

   #Microsoft Windows
   set PATH=<Infrastructure Management Server Installation Directory>\pw\jre\bin;%PATH%
   
   #Unix
   export PATH=<Infrastructure Management Server Installation Directory>/pw/jre/bin:$PATH

2. Navigate to the <Infrastructure Management Server Installation Directory>\pw\jre\lib\security directory, and import the procured certificate by running the following commands:

   keytool -import -alias cassoserver -file casso.crt -keystore messagebroker.ts

   Parameter description

   The following notes describe the key parameters used in the preceding command:

   • casso.crt is the name of the CA signed certificate procured from the BMC Atrium Single Sign-On system security administrator. If the name of the procured certificate is different, use the relevant file name in the preceding command.
   • messagebroker.ts is the Infrastructure Management server truststore file name.

To import the security certificates into the Presentation Server truststore

The Presentation Server uses the tspstruststore.ts truststore to cummunicate with the BMC Atrium Single Sign-On. This truststore is bundled along with the Presentation Server installation, and is located in the <Presentation Server Installation Directory>\TruesightPServer\jre\lib\security directory. Perform the following steps to import the security certificates into this truststore:

1. Log on to the computer where the Presentation Server is installed. The keytool utility that is used to import the certificates is present in the <Presentation Server Installation Directory>\jre\bin directory. Add this directory path to the PATH environment variable by running the following command:

   #Microsoft Windows
   set PATH=<Presentation Server Installation Directory>\jre\bin;%PATH%
    
   #Unix
   export PATH=<Presentation Server Installation Directory>/jre/bin:$PATH

2. Navigate to the <Presentation Server Installation Directory>\TruesightPServer\jre\lib\security directory, and import the procured certificate by running the following commands:

   keytool -import -alias cassoserver -file casso.crt -keystore tspstruststore.ts

   Parameter description

   The following notes describe the key parameters used in the preceding command:
   

   • casso.crt is the name of the CA signed certificate procured from the BMC Atrium Single Sign-On system security administrator. If the name of the procured certificate is different, use the relevant file name in the preceding command.
   • tspstruststore.ts is the Presentation Server truststore file name.

   • get2net is the default password for the tspstruststore.ts keystore. If you want to change this password, run the following command:

     keytool -storepasswd -keystore tspstruststore.ts

     Provide the complete path for the keystore file in the preceding command, if you are running this command outside of the keystore directory location.

To import the security certificates for the Infrastructure Management Server to Oracle database communication

1. Log on to the computer where the Infrastructure Management Server is installed. The keytool utility that is used to import the certificates is present in the <Infrastructure Management Server Installation Directory>\pw\jre\bin directory. Add this directory path to the PATH environment variable by running the following command:

   #Microsoft Windows
   set PATH=<Infrastructure Management Server Installation Directory>\pw\jre\bin;%PATH%
   
   #Unix
   export PATH=<Infrastructure Management Server Installation Directory>/pw/jre/bin:$PATH
2. Import the procured certificates by running the following command:

   keytool -importcert -trustcacerts -file oracle.crt -keystore messagebroker.ts -alias oracleCert

   Note

   • oracle.crt is the name of the Oracle certificate. If the name of the Oracle Wallet certificate procured from your oracle database administrator is different, use the relevant file name in the preceding command.

Integration Service communicates with the PATROL Agent and the Infrastructure Management Server. Integration Service needs to import certificates for the following types of communication:

• To import the certificates for the Integration Service to PATROL Agent communication
• To import the security certificates for the Integration Service to Infrastructure Management Server, and the cell communication

To import the certificates for the Integration Service to PATROL Agent communication

Perform the following steps to import the security certificates to the Integration Service certificate store which is in Mozilla NSS DB store format:

1. Navigate to the directory by running the following command: 

   # Microsoft Windows operating system
   $cd <IS installation directory>\Agent\patrol\common\security\config_v3.0
   
   # Unix operating system
   $cd <IS installation directory>/Agent/patrol/common/security/config_v3.0

2. Create a Mozilla certificate store on the Integration Service.

   #On Microsoft Windows
   $mkdir <IS installation directory>\Agent\patrol\common\security\config_v3.0\ISAsServer_DB
   $certutil -N -d sql:<installationdirectory>\Agent\patrol\common\security\config_v3.0\ISAsServer_DB
   
   #On Unix
   $mkdir <IS installationdirectory>/Agent/patrol/common/security/config_v3.0/ISAsServer_DB
   $certutil -N -d sql:<installationdirectory>/Agent/patrol/common/security/config_v3.0/ISAsServer_DB

   Note

   ISAsServer_DB is the name of the server certificate store for the Integration Service

3. Procure the private key from your security administrator, and place them in the <IS installation directory>\Agent\patrol\common\security\config_v3.0\ISAsServer_DB>directory.

4. If the private key is in public-key cryptography standards 12 format (PKCS12) format, import this certificate using the following command: 

   pk12util pk12util -i server.p12 -d sql: <IS installationdirectory>\Agent\patrol\common\security\config_v3.0\ISAsServer_DB -W <password>

    

   Note

   ISAsServer_DB is the name of the server certificate store for the Integration Service

5. Procure the CA signed certificate form your system administrator and place it in the <IS installation directory>\Agent\patrol\common\security\config_v3.0\ISAsServer_DB>.

6. Import the procured CA certificates to the Integration Service's server certificate store by running the following command:

   certutil -d sql: <IS installationdirectory>\Agent\patrol\common\security\config_v3.0\ISAsServer_DB -A -n "Trusted IS CA" -t "CT,," -a -i ca.crt

   Parameter description

   The following notes describe the key parameters used in the preceding command:

   • ca.crt is the CA certificate file name.
   • <IS installation directory>\Agent\patrol\common\security\config_v3.0\ISAsServer_DB is the path to build the Mozilla NSS server certificate Store
   • “Trusted IS CA” is the certificate alias name
   • “CT” is the flag to markcertificateas trusted.
   • You need to import the complete chain of CA certificatesuptoroot CA certificate using the same command.

To import the security certificates for the Integration Service to Infrastructure Management Server, and the cell communication

Integration Service uses the pnagent.ks keystore while communicating with the Infrastructure Management Server and the cell. This keystore file is bundled along with the Integration Service installation, and are located in the <Infrastructure Management Install Directory>\pw\pronto\conf directory. Perform the following steps to import the security certificates into thekeystore file:

1. Log on to the computer where the Integration Service is installed. The keytoolutility that is used to import the certificates is present in the <Infrastructure Management Server Installation Directory>\pw\jre\bin directory. Add this directory path to the PATH environment variable by running the following command:

   #Microsoft Windows
   set PATH=<Infrastructure Management Server Installation Directory>\pw\jre\bin;%PATH%
   
   #Unix
   export PATH=<Infrastructure Management Server Installation Directory>/pw/jre/bin:$PATH

2. Navigate to the <Infrastructure Management Install Directory>\pw\pronto\conf directory and import the procured certificate by running the following command:

   keytool -importkeystore -deststorepass get2net -destkeypass get2net -destkeystore pnagent.ks -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass password
    
   keytool -import -alias cell -file mcell.crt -keystore pnagent.ks

   Parameter description

   The following notes describe the key parameters used in the preceding commands:

   • server.p12 is the name of the private key file which is in PKCS12 format. If the name of private key procured from your system administrator is different, use the relevant file name in the preceding command.
   • mcell.crt is the name of the cell certificate. If the name of the cell certificate is different, use the relevant file name in the preceding command.

   • get2net is the default password for the pnagent.ks keystore. If you want to change this password, run the following command:

     keytool -storepasswd -keystore pnagent.ks

     Provide the complete path for the keystore file in the preceding command, if you are running this command outside of the keystore directory location.

   • password is the password for the server.p12 private key.

To import the security certificates into the PATROL Agent certificate store

PATROL Agent communicates with the Integration Service, PATROL console, and the remote cell.

The PATROL Agent acts as a client or a server based on the components with which it communicates, as explained in the following section:

• PATROL Agent to Integration Service communication: PATROL Agent acts as a client.
• PATROL Agent to PATROL console communication: PATROL Agent acts as a server.
• PATROL Agent to remote cell communication: PATROL Agent acts as a client.

TLS mode of communication requires the client, and the server to have public key infrastructure (PKI) certificates deployed in their respective certificate stores. The authentication process varies depending on the PATROL Agent's role as a server or a client, as explained in the following sections:

PATROL Agent configured as a client

PATROL Agent operates as a client when it is communicating with the Integration Service, and the remote cell. To enable the TLS handshake, deploy the Mozilla NSS certificates in the DB store format at the PATROL Agent. There are two security options as explained in the following section:

• Integration Service is authenticated by the PATROL Agent: To enable the PATROL Agent to authenticate the server, import the Certificate Authority (CA) certificates of the Integration Service or remote cell to the PATROL Agent certificate store. This is in continuation to the Security Level 3 implementation of the previous versions of the PATROL Agent communication.
• Integration Service is not authenticated by the PATROL Agent: In a trusted environment, if the PATROL Agent administrator can ensure the authenticity of the Integration Service Host, or the remote cell the PATROL Agent can be configured to bypass sever authentication. This is in continuation to the Security Level 2 implementation of the previous versions of the PATROL Agent communication.

The following sections explain the procedure to implement the preceding security mechanisms:

Integration Service is not authenticated by the PATROL Agent

In this scenario, the Integration Service certificates are not imported to the PATROL Agent certificate store. You can proceed to configure the PATROL Agent to enable TLS 1.2 mode.

Integration Service is authenticated by the PATROL Agent

Perform the following steps to import the security certificates to the PATROL Agent certificate store.

1. Create a Mozilla certificate store on the central server for the PATROL Agent.
   Run the following command

   #On Microsoft Windows
   $mkdir <installationdirectory>\common\security\keys\PatrolAsClient_DB
   $certutil -N -d sql:<installationdirectory>\common\security\keys\PatrolAsClient_DB
   
   #On Unix
   $mkdir <installationdirectory>/common/security/keys/PatrolAsClient_DB
   $certutil -N -d sql:<installationdirectory>/common/security/keys/PatrolAsClient_DB
   

   • PatrolAsClient_DB is the name of the client certificate store for the PATROL Agent

2. Procure CA certificates of the Integration Service from your security administrator, and place them in the <installationdirectory>\common\security\keys\PatrolAsClient_DB directory.

   • You can choose the PatrolAsClient_DB path, and create directories as per the defined path.
   • You can generate self-signed certificates by using one of the tools such as: Oracle keytool, OpenSSL, Mozilla NSS. For more information, see Creating self-signed certificates

3. Import the CA certificate to the PATROL Agent client certificate store.
   Run the following command

   certutil -d sql: <installationdirectory>\common\security\keys\PatrolAsClient_DB -A -n "Trusted IS CA" -t "CT,," -a -i ca.crt

   • ca.crt is the CA certificate file name.
   • <installationdirectory>\common\security\keys\PatrolAsClient_DB is the path to build the Mozilla NSS client certificate Store
   • “Trusted IS CA” is the certificate alias name
   • “CT” is the flag to mark certificate as trusted.
   • You need to import the complete chain of CA certificates upto root CA certificate using the same command

4. If the CA certificates are in public-key cryptography standards 12 (PKCS12) format, import the certificate using the following command.

   $pk12util pk12util -i client.p12 -d sql: <installationdirectory>\common\security\keys\PatrolAsClient_DB -W <password>

   • client.p12 is name of the client certificate in the PKCS12.
   • password is the password string for the client.p12 file
5. Perform the configuration changes needed to enable TLS 1.2 mode.

PATROL Agent configured as a server

Perform the following steps, when PATROL Agent is communicating with the PATROL console.

1. Create a Mozilla certificate store on the central server for the PATROL Agent.
   Run the following command

   #On Microsoft Windows
   $mkdir <installationdirectory>\common\security\keys\PatrolAsServer_DB
   $certutil -N -d sql:<installationdirectory>\common\security\keys\PatrolAsServer_DB
   
   #On Unix
   $mkdir ./<installationdirectory>/common/security/keys/PatrolAsServer_DB
   $certutil -N -d sql:./<installationdirectory>/common/security/keys/PatrolAsServer_DB

   • PatrolAsServer_DB is the name of the server certificate store for the PATROL Agent

2. Procure the CA certificates from your organisation's security administrator, and place them in the <installationdirectory>\common\security\keys\PatrolAsServer_DB directory.

   • You can choose the PatrolAsServer_DB path, and create directories as per the defined path.
   • You can generate self-signed certificates by using one of the tools such as: Oracle keytool, OpenSSL, Mozilla NSS. For more information, see Creating self-signed certificates

3. Import the procured CA certificates to the PATROL Agent server certificate store.
   Run the following command

   certutil -d sql: <installationdirectory>\common\security\keys\PatrolAsServer_DB -A -n "Trusted IS CA" -t "CT,," -a -i ca.crt

   • ca.crt is the CA certificate file name.
   • <installationdirectory>\common\security\keys\PatrolAsServer_DB is the path to build the Mozilla NSS server certificate Store
   • “Trusted IS CA” is the certificate alias name
   • “CT” is the flag to mark certificate as trusted.
   • You need to import the complete chain of CA certificates upto root CA certificate using the same command

4. If the CA certificates are in public-key cryptography standards 12 (PKCS12) format, import the certificate using the following command.

   pk12util pk12util -i server.p12 -d sql: <installationdirectory>\common\security\keys\PatrolAsServer_DB -W <password>

   PatrolAsServer_DB is the name of the server certificate store for the PATROL Agent

5. Perform the configuration changes needed to enable TLS 1.2 mode.

To import the security certificates into the Impact Integration Web Services

Impact Integration Web Services (IIWS) uses the iiws.ks keystore for its communication. This keystore file is bundled along with the IIWS installation, and is located in the <Impact Web Services Install Directory>\Tomcat\webapps\imws\WEB-INF\etc directory. Perform the following steps to import the security certificates into this keystore file:

1. Log on to the computer where the IIWS is installed. The keytool utility that is used to import the certificates is present in the <Impact Web Services install directory>\BMCIIWSJVM\bin directory. Add this directory path to the PATH environment variable by running the following command:

   #Microsoft Windows
   set PATH=<Impact Web Services install directory>\BMCIIWSJVM\bin;%PATH%
   
   #Unix
   export PATH=<Impact Web Services install directory>/BMCIIWSJVM/bin:$PATH

   
   

2. Navigate to the <Impact Web Services Install Directory>\Tomcat\webapps\imws\WEB-INF\etc directory, and import the procured certificate by running the following command:

   keytool -import -alias caserver -file ca.crt -keystore iiws.ks

   Parameter description

   The following notes describe the key parameters used in the preceding command:
   

   • ca.crt is the name of the CA signed certificate. If the name of the CA signed certificate procured from your system administrator is different, use the relevant file name in the preceding command.
   • If you want to use self-signed certificate instead of the CA signed certificate, see Creating self-signed certificates.

Importing security certificates to communicate with other BMC products

• BMC TrueSight Presentation Server communicates with the following products over HTTPS, and acts as a client in this context of communication.
  • BMC BladeLogic
  • BMC Atrium Single Sign-On
  • BMC Remedy Application Request Change Management System
• BMC TrueSight Presentation Server communicates with the following BMC products over HTTPS, and acts as a server in this context of communication.
  • BMC TrueSight IT Data Analytics
  • BMC TrueSight Capacity Optimization
  • BMC TrueSight App Visibility Manager

To import the security certificates into the Presentation Server truststore

The Presentation Server uses the tspstruststore.ts truststore to communicate with the BMC BladeLogic, and BMC Remedy Application Request Change Management System. This truststore is bundled along with the Presentation Server installation, and is located in the <Presentation Server Installation Directory>\TruesightPServer\jre\lib\security directory. Perform the following steps to import the security certificates into this truststore:

1. Log on to the computer where the Presentation Server is installed. The keytool utility that is used to import the certificates is present in the <Presentation Server Installation Directory>\jre\bin directory. Add this directory path to the PATH environment variable by running the following command:

   #Microsoft Windows
   set PATH=<Presentation Server Installation Directory>\jre\bin;%PATH%
    
   #Unix
   export PATH=<Presentation Server Installation Directory>/jre/bin:$PATH

2. Navigate to the <Presentation Server Installation Directory>\TruesightPServer\jre\lib\security directory, and import the procured certificate by running the following commands:

   keytool -import -alias cabladeserver -file cablade.crt -keystore tspstruststore.ts
    
   keytool -import -alias caarcms -file caarcms.crt -keystore tspstruststore.ts

   Parameter description

   The following notes describe the key parameters used in the preceding command:

   • cablade.crt is the name of the CA signed certificate procured from the BMC BladeLogic system security administrator. If the name of the procured certificate is different, use the relevant file name in the preceding command.
   • caarcms.crt is the name of the CA signed certificate procured from the BMC Remedy Application Request Change Management System security administrator. If the name of the procured certificate is different, use the relevant file name in the preceding command.
   • tspstruststore.ts is the Presentation Server truststore file name.

   • get2net is the default password for the tspstruststore.ts keystore. If you want to change this password, run the following command:

     keytool -storepasswd -keystore tspstruststore.ts

     Provide the complete path for the keystore file in the preceding command, if you are running this command outside of the keystore directory location.