Enabling TLS authentication between BMC AMI Manager and Docker

Use one of these procedures to enable TLS for communication between BMC AMI Manager and Docker.

Related topic

Configuring-after-installation

Before you begin

  • To configure TLS, you need a digital certificate. You should have obtained or generated one before you installed. See TLS Authentication for more details.
  • If you do not have OpenSSL installed, install it before proceeding.
  • If you are want to use the same certificate and key file when running BMC AMI Ops Insight Playback Docker container on your local machine, you must have amioidashboard.com as one of the SAN (Subject Alternative Name) entry.

To implement a certificate issued by a Certificate Authority (CA)

  1. Use the following command to generate a key.openssl genrsa -out <server>.key 2048
  2. Use the key you generated in the previous step to request a CA certificate.
  3. Use one of the following commands to extract the .cer file. Replace < certificate > with the name of your certificate:
    • For PKCS #7: openssl pkcs7 -print_certs -in <certificate>.p7b -out <certificate>.cer

    • For PKCS #12: openssl pkcs12 -in <certificate>.pfx (or .p12) -out <certificate>.cer -nodes

      Important

      The file extension for PKCS #12 can be .pfx or .p12.

  4. Use the following command to convert the certificate you created in the previous step (<certificate>.cer)to X.509 format.openssl x509 -in <certificate>.cer -outform PEM -out <certificate>.crt
  5. Proceed with Importing the certificate to the truststore.

To implement a self-signed certificate

  1. Create a configuration file < openssl > .cnf similar to the following:

    [req]
    distinguished_name = req_distinguished_name
    req_extensions = v3_req
    [req_distinguished_name]
    countryName = <myCountry>
    countryName_default = <myCountry>
    stateOrProvinceName = <myProvince>
    stateOrProvinceName_default = <myProvince>
    localityName = <myLocality>
    localityName_default = <myLocality>
    organizationName = <Org>
    organizationName_default = <Org>
    organizationalUnitName = <myOrgUnit>
    organizationalUnitName_default =<myOrgUnit>
    commonName = <hostName>
    commonName_max = 64
    [ v3_req ]
    # Extensions to add to a certificate request
    basicConstraints = CA:FALSE
    keyUsage = nonRepudiation, digitalSignature, keyEncipherment
    subjectAltName = @alt_names
    [alt_names]
    DNS.1 = <hostname>
    DNS.2 = *
    DNS.3 = *.com
    DNS.4 = *.*.com
    DNS.5 = *.*.*.com
    DNS.6 = *.*.*.*.com
    DNS.7 = amioidashboard.com
  2. Use the following command to generate a key:openssl genrsa -out <server>.key 2048
  3. Use the following command to create a Certificate Signing Request (CSR).openssl req -new -out <server>.csr -key <server>.key -config <openssl>.cnf
  4. Use the following command to create a certificate using the key and CSR that you created in the previous steps.openssl x509 -req -days 3650 -in <server>.csr -signkey <server>.key -out <server>.crt -extensions v3_req -extfile <openssl>.cnf
  5. Proceed with Importing the certificate to the truststore.

Importing the certificate to the truststore

  1. Copy your X.509 certificate file to the system where BMC AMI Manager is installed.
  2. Run the following command on the system where BMC AMI Manager is installed:

keytool -import -trustcacerts -keystore <full path to your truststore file> -storepass changeit -noprompt -alias < alias name > -file <full path to certificate file>

Important

The truststore must be the one specified in the #TrustStore Configuration section of the amipdt.properties file. The file is located in <Install_Path>/aoidata/aoiinst/conf.

Set the trustStore properties in the AMICMNEV member of the &HLQ.UBBSAMP data set as follows:

Property

Variable

Truststore type 

AMIAPS_TRUSTSTORE_TYPE=    

Truststore name 

AMIAPS_TRUSTSTORE_NAME=  

Truststore password   

AMIAPS_TRUSTSTORE_PASSWORD=

     

Starting Docker with a new certificate for optional graph component

  1. If the docker container was already running, run the following commands to stop and remove the Docker container.
    docker stop <my_container>
    For example: docker stop amioi-server
    docker rm <my_container>For example: docker rm amioi-server
  2. Use one of the following commands to start Docker using your certificate.

    • On Linux, run the following command:./container-shell-lpqmb1.2.00.sh u=< EPD_Username > crt=< crtFilePath > key=< keyFilePath >

      For example: ./container-shell-lpqmb1.2.00.sh u=somebody crt=certificate.crt key=private.key

    • On zCX/zLinux, run the following command:./run.sh crt=<crtFilePath> key=<keyFilePath>

      For example: ./run.sh crt=certificate.crt key=private.key

  3. Restart BMC AMI Manager.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*