Important This documentation space contains information about PATROL Agents when deployed in a TrueSight Operations Management environment. If you are a BMC Helix Operations Management user, see PATROL Agent 23.1 for BMC Helix Operations Management.

Changing the security certificate configuration options

If you want to change the security certificate configurations after the PATROL Agent installation, perform the following steps.

Windows

The following table lists the steps to change security validations in Windows:

Changing from No Certificate Validation to Certificate Validation option

Changing from Certificate Validation to No Certificate Validation option

  1. Stop the PATROL Agent.
  2. Navigate to %{/BMC/INSTBASE}\common\security\config_v3.0.
  3. Run the following command:
    set_unset_tls.cmd %{/BMC/INSTBASE} UNSET_TLS 2
  4. Run the following command:
    set_unset_tls.cmd %{/BMC/INSTBASE} SET_TLS 2 -serverDbPath %{/BMC/INSTBASE}\common\security\config_v3.0\demo_certs\nss\demo_server -clientDbPath %{/BMC/INSTBASE}\common\security\config_v3.0\demo_certs\nss\demo_client -identity "PatrolServer - BMC"
  5. Restart the PATROL Agent.
  1. Stop the PATROL Agent.
  2. Navigate to %{/BMC/INSTBASE}\common\security\config_v3.0.
  3. Run the following command:
    set_unset_tls.cmd %{/BMC/INSTBASE} UNSET_TLS 2 -serverDbPath %{/BMC/INSTBASE}\common\security\config_v3.0\demo_certs\nss\demo_server -clientDbPath %{/BMC/INSTBASE}\common\security\config_v3.0\demo_certs\nss\demo_client -identity "PatrolServer - BMC"
  4. Run the following command:
    set_unset_tls.cmd %{/BMC/INSTBASE} SET_TLS 2
  5. Restart the PATROL Agent.

The identity parameter must match the corresponding alias in the NSS cert DB.

Use the following command to view the alias name and certificate list:

certutil -L -d  sql : PatrolAsServer_DB

For more information, see 

UNIX

The following table lists the steps to change security validations in UNIX:

Changing from No Certificate Validation to Certificate Validation option

Changing from Certificate Validation to No Certificate Validation option

  1. Stop the PATROL Agent.
  2. Navigate to $BMC_BASE/common/security/config_v3.0.
  3. Run the following command:
    ./set_unset_tls.sh "/opt/bmc/Patrol_Agent" UNSET_TLS 2 
  4. Run the following command:
    ./set_unset_tls.sh "/opt/bmc/Patrol_Agent" SET_TLS 2 -serverDbPath "/tmp/Certificates/server_db" -clientDbPath "/tmp/Certificates/client_db" -identity "bmcpatrol"
  5. Restart the PATROL Agent.
  1. Stop the PATROL Agent.
  2. Navigate to $BMC_BASE/common/security/config_v3.0.
  3. Run the following command:
    ./set_unset_tls.sh "/opt/bmc/Patrol_Agent" UNSET_TLS 2 -serverDbPath "/tmp/Certificates/server_db" -clientDbPath "/tmp/Certificates/client_db" -identity "bmcpatrol"
  4. Run the following command:
    ./set_unset_tls.sh "/opt/bmc/Patrol_Agent" SET_TLS 2 
  5. Restart the PATROL Agent.


The certificate location varies based on the root certificates imported from the Integration Services.

The p7_change_security_level* script is deprecated from the 22.3.01 version of PATROL Agent. 


The identity parameter must match the corresponding alias in the NSS cert DB.

Use the following command to view the alias name and certificate list:

certutil -L -d  sql : PatrolAsServer_DB

For more information, see PATROL Agent registry setting.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*