Configuring to consume over SSL or with client certificates
If you want to consume web services over SSL or with client certificates, add the Java keystore options in the arserver.config(arserverd.conf) file.
Self-signed certificates or certificates signed by CAs that are not trusted by clients and servers causes maintenance tasks. Using Well known certificate authorities lowers the number of manual tasks and integration disruptions.
If you want to use certificates that are not trusted, make sure to check your internal procedures with the security team in your organization to prevent importing certificates in the future.
Examples
When you create a dedicated keystore without using Java cacerts (jre/lib/security/cacerts), an SSL handshake error might occur while consuming external web services on HTTPS. To overcome this issue, you must import all Java cacerts content into the keystore/trustore.
Refer to the following example:
You must add only the signed certificate. Use the truststore parameter to point to your file.
For one way SSL, add the following Java keystore options in the arserver.config(arserverd.conf) file:
jvm.option.XX+1=-Djavax.net.ssl.trustStorePassword=<password>
jvm.option.XX+2=-Djavax.net.ssl.keyStoreType=<keystore Type>
For example:
jvm.option.XX+1=-Djavax.net.ssl.trustStorePassword=****
jvm.option.XX+2=-Djavax.net.ssl.trustStoreType=JKS
Refer to the following example if you are not using Java Cacerts for the AR System server process.
jvm.option.XX+1=-Djavax.net.ssl.trustStorePassword=****
jvm.option.XX+2=-Djavax.net.ssl.trustStoreType=pkcs12
If you want to use similar certificates for other processes such as JAVA Plug-in server, update the armonitor.conf file. Refer to the following example for Java Plug-in server:
Refer to the following example for the developerstudio.ini file:
-Djavax.net.ssl.trustStore=/opt/bmc/arsystem/conf/certificates.p12
-Djavax.net.ssl.trustStorePassword=****
-Djavax.net.ssl.trustStoreType=pkcs12
For two way SSL, add the following Java keystore options in the arserver.config(arserverd.conf) file:
jvm.option.XX+1=-Djavax.net.ssl.keyStorePassword=*****
jvm.option.XX+2=-Djavax.net.ssl.trustStore=<pathToTrustStore>
jvm.option.XX+3=-Djavax.net.ssl.trustStorePassword=<password>
jvm.option.XX+4=-Djavax.net.ssl.keyStoreType=<keyStore Type>
jvm.option.XX+5=-Djavax.net.ssl.trustStoreType=<TrustStore Type>
For example:
jvm.option.XX+1=-Djavax.net.ssl.keyStorePassword=*****
jvm.option.XX+2=-Djavax.net.ssl.trustStore=/opt/bmc/arsystem/conf/certificates.p12
jvm.option.XX+3=-Djavax.net.ssl.trustStorePassword=****
jvm.option.XX+4=-Djavax.net.ssl.keyStoreType=JKS
jvm.option.XX+5=-Djavax.net.ssl.trustStoreType=pkcs12
The following sample code illustrates jvm.option example:
jvm.option.2=-Djavax.xml.transform.TransformerFactory=org.apache.xalan.processor.TransformerFactoryImpl
jvm.option.3=-Dlogback.configurationFile=file:../conf/logback_server.xml
jvm.option.4=-Xss2M
jvm.option.5=-XX:MetaspaceSize=256M
jvm.option.6=-XX:MaxMetaspaceSize=512M
jvm.option.7=-Dcom.sun.management.jmxremote
jvm.option.8=-Dcom.bmc.arsys.boot.flavor=server
jvm.option.9=-XX:OnOutOfMemoryError=./kill-server
jvm.option.10=-Djetty.home=../jetty
jvm.option.11=-Dorg.eclipse.equinox.http.jetty.autostart=false
jvm.option.12=-XX:ErrorFile=file:../db/arserverjvmcrash_PID%p.log
jvm.option.13=-XX:+HeapDumpOnOutOfMemoryError
jvm.option.14=-XX:HeapDumpPath=../Logs
jvm.option.15=-XX:+UseCompressedOops
jvm.option.16=-XX:+UseConcMarkSweepGC
jvm.option.17=-XX:+UseParNewGC
jvm.option.18=-XX:NewRatio=2
For SSL support, you must add the jvm options starting from 19 (any other number in the sequence is not initiated on the actual service) as shown in the following example code snippet:
jvm.option.20=-Djavax.net.ssl.keyStorePassword=*****
jvm.option.21=-Djavax.net.ssl.trustStore=/opt/bmc/arsystem/conf/certificates.p12
jvm.option.22=-Djavax.net.ssl.trustStorePassword=****
jvm.option.23=-Djavax.net.ssl.keyStoreType=JKS
jvm.option.24=-Djavax.net.ssl.trustStoreType=pkcs12
Restart the AR System server after all the configurations are complete.
Related topics
Configuring-the-Mid-Tier-web-server-for-SSL-certificate
Accessing-WSDL-or-web-services-over-https