Configuring to consume over SSL or with client certificates
Examples
When you create a dedicated keystore without using Java cacerts (jre/lib/security/cacerts), an SSL handshake error might occur while consuming external web services on HTTPS. To overcome this issue, import all Java cacerts content into the keystore/trustore. Refer to the following example:
You must add only the signed certificate. Use the truststore parameter to point to your file.
For one-way SSL, add the following Java keystore options in the arserver.config (arserverd.conf) file:
jvm.option.XX+1=-Djavax.net.ssl.trustStorePassword=<password>
jvm.option.XX+2=-Djavax.net.ssl.keyStoreType=<keystore Type>
For example:
jvm.option.XX+1=-Djavax.net.ssl.trustStorePassword=****
jvm.option.XX+2=-Djavax.net.ssl.trustStoreType=JKS
If you are not using Java Cacerts for the AR System server process, refer to the following example:
jvm.option.XX+1=-Djavax.net.ssl.trustStorePassword=****
jvm.option.XX+2=-Djavax.net.ssl.trustStoreType=pkcs12
If you want to use similar certificates for other processes such as JAVA Plug-in server, update the armonitor.conf file. Refer to the following example for Java Plug-in server:
Refer to the following example for the developerstudio.ini file:
-Djavax.net.ssl.trustStore=/opt/bmc/arsystem/conf/certificates.p12
-Djavax.net.ssl.trustStorePassword=****
-Djavax.net.ssl.trustStoreType=pkcs12
For two-way SSL, add the following Java keystore options in the arserver.config (arserverd.conf) file:
jvm.option.XX+1=-Djavax.net.ssl.keyStorePassword=*****
jvm.option.XX+2=-Djavax.net.ssl.trustStore=<pathToTrustStore>
jvm.option.XX+3=-Djavax.net.ssl.trustStorePassword=<password>
jvm.option.XX+4=-Djavax.net.ssl.keyStoreType=<keyStore Type>
jvm.option.XX+5=-Djavax.net.ssl.trustStoreType=<TrustStore Type>
For example:
jvm.option.XX+1=-Djavax.net.ssl.keyStorePassword=*****
jvm.option.XX+2=-Djavax.net.ssl.trustStore=/opt/bmc/arsystem/conf/certificates.p12
jvm.option.XX+3=-Djavax.net.ssl.trustStorePassword=****
jvm.option.XX+4=-Djavax.net.ssl.keyStoreType=JKS
jvm.option.XX+5=-Djavax.net.ssl.trustStoreType=pkcs12
You must start the jvm.option.XX sequence after the last jvm.option in the arserver.config (arserverd.conf) file.
If the arserver.config(arserverd.config) file has jvm.option.19 as last jvm option, add the jvm options starting from jvm.option.20.
The following sample code illustrates jvm.option example:
jvm.option.2=-Djavax.xml.transform.TransformerFactory=org.apache.xalan.processor.TransformerFactoryImpl
jvm.option.3=-Dlogback.configurationFile=file:../conf/logback_server.xml
jvm.option.4=-Xss2M
jvm.option.5=-XX:MetaspaceSize=256M
jvm.option.6=-XX:MaxMetaspaceSize=512M
jvm.option.7=-Dcom.sun.management.jmxremote
jvm.option.8=-Dcom.bmc.arsys.boot.flavor=server
jvm.option.9=-XX:OnOutOfMemoryError=./kill-server
jvm.option.10=-Djetty.home=../jetty
jvm.option.11=-Dorg.eclipse.equinox.http.jetty.autostart=false
jvm.option.12=-XX:ErrorFile=file:../db/arserverjvmcrash_PID%p.log
jvm.option.13=-XX:+HeapDumpOnOutOfMemoryError
jvm.option.14=-XX:HeapDumpPath=../Logs
jvm.option.15=-XX:+UseCompressedOops
jvm.option.16=-XX:+UseConcMarkSweepGC
jvm.option.17=-XX:+UseParNewGC
jvm.option.18=-XX:NewRatio=2
For SSL support, you must add the jvm options starting from 19 (any other number in the sequence is not initiated on the actual service) as shown in the following example code snippet:
jvm.option.20=-Djavax.net.ssl.keyStorePassword=*****
jvm.option.21=-Djavax.net.ssl.trustStore=/opt/bmc/arsystem/conf/certificates.p12
jvm.option.22=-Djavax.net.ssl.trustStorePassword=****
jvm.option.23=-Djavax.net.ssl.keyStoreType=JKS
jvm.option.24=-Djavax.net.ssl.trustStoreType=pkcs12
Restart the AR System server after all the configurations are complete.