Introduction

ServiceDesk Plus - MSP can run as a HTTPS service. But it requires a SSL (Secure Socket Layer) Certificate signed by a valid Certificate Authority (CA).

By default, on a first-time start-up, it creates a self-signed certificate. This self-signed certificate will not be trusted by the user browsers. Thus, while connecting to ServiceDesk Plus - MSP, you need to manually verify the certificate information and the hostname of ServiceDeskPlus - MSP server carefully and should force the browser to accept the certificate.

To make ServiceDeskPlus - MSP server identify itself correctly to the web browser and the user, you need to obtain a new signed certificate from a CA for the ServiceDesk Plus - MSP host. You can use keytool (bundled with Java) to create your certificates, get them signed by a CA and use them with ServiceDesk Plus - MSP.

Steps to install SSL in ServiceDesk Plus - MSP

The steps involved in configuring ServiceDesk Plus - MSP to use the SSL are as given below.         

Step 1: Create a Keystore file

Step 2: Create .CSR (Certificate Signing Request) file

Step 3: Install your SSL Certificate

Step 4: Configuring the Server

NOTE: In all the images, replace the highlighted text with the alias name you want to use for the ServiceDesk Plus - MSP.

1. Open the Command Prompt.
   

2. From the location <installation directory> \ jre \ bin execute the command
   

keytool -genkey -alias <your_alias_name> or [Domain Name] -keyalg RSA -keystore sdp.keystore

3. If your vendor requires a CSR of size 2048 please use the command given below.
   

keytool -genkey -alias <your_alias_name> or [Domain Name] -keyalg RSA -keysize 2048 -keystore sdp.keystore

4. You will then be prompted to choose a password for your keystore.
   

NOTE: Please note that the Password should not contain $ symbol.

6. If you are ordering a Wildcard Certificate this must begin with the * character.
   

7. On entering the required information, confirm that the information is correct by entering 'y' or 'yes' when prompted.
   

8. At the end of executing the above command, you will be prompted to enter keystore password. Try giving the password same as your key password. Make sure to remember the password you choose.
   

9. Your keystore file named sdp.keystore is now created in your current working directory.
   

NOTE: We request you to make a backup copy of the sdp.keystore file before installing the Certs. This backed up keystore can be used if the certificate installation goes wrong or when you renew your certificates the next year.

Step 2: Creating .CSR (Certificate Signing Request) file

The .CSR (Certificate Signing Request) file is temporary and should be submitted to a CA to receive CA-Signed Certificate files.

Please follow the steps given below to create the CSR file.

1. Open the Command Prompt
   

2. From the location <installation directory> \ jre \ bin execute the below command.
   

keytool -certreq -alias <your_alias_name> -file key.csr -keystore sdp.keystore

In the above command <your_alias_name>  is the alias name provided when creating the keystore, key.csr is the name of the CSR file that will be created after the command is executed.

Step 3: Install your SSL Certificate

Download the Certificate files received from the CA via e-mail to the directory where your keystore (sdp.keystore) was saved during the CSR creation process. The certificates must be installed to this exact keystore. If you try to install it to a different keystore it will not work.

The certificates you had downloaded must be installed to your keystore in the correct order for your certificate to be trusted. If the certificates are not installed in the correct order, then the certificate will not authenticate properly. To find the correct order, double click on the domain certificate and then go to ‘Certification Path’.

These certificates are usually in the format .cer or .crt. If your certificate is with the extension .p7b please follow the instructions given in Installing a .P7b Certificate to export the certs to a .cer or .crt format.

Looking at the above certification path we can infer that we need to import two other certificates before the domain certificate. First is the Root, next the Intermediate and finally the Domain Certificate. Some CAs may also use another certificate called Cross Intermediate. These certificates can be downloaded from the Vendor’s website.


Installing the Root Certificate file

Each time you install a certificate to your keystore you will be prompted for the keystore password, which you chose while generating your CSR. Type the following command to install the Root certificate file:

keytool -import -trustcacerts -alias root -file <File_Name>.crt -keystore sdp.keystore

NOTE: Choose ‘Yes’ if you get prompted with a message that says "Certificate already exists in system-wide CA keystore under alias <Alias Name> Do you still want to add it to your own keystore? [no]:"

You will get a confirmation stating that the "Certificate was added to keystore".

Step 4: Configuring the Server

1. Copy the sdp.keystore file from <ServiceDeskPlus-MSP_Home>\jre\bin to <ServiceDeskPlus-MSP_Home>\server\default\conf
   

2. From the command prompt, execute changeWebServerPort.bat script to change the connection mode to HTTPS.
   

Cmd>[ServiceDesk Plus-MSP_Home]\bin> changeWebServerPort.bat <WEBSERVER_PORT> https

3. Finally, update the name of the keystore and the password, you gave in Step 1, while generating sdp.keystore  in the file server.xml present under <ServiceDeskPlus-MSP_Home>\server\default\deploy\jbossweb-tomcat50.sar
   
   
   
   

4. Restart the service ManageEngine ServiceDesk Plus - MSP for the changes to take effect.
   
   

   Install a .P7b Certificate
   

   Some CA will provide the certificates with an extension .p7b. In such a case you can double click on this file to open a console which will list all the required certificates. You can export these certificates to Base-64 encoded X.509 (.cer) files. (Please refer to the Screenshots given below).
   

   These certs can then be installed onto the keystore file using the instructions given in Step 3.
   

   To export the certificate,
   

   1. Go to [ServiceDesk Plus - MSP Home] \ jre \ bin \ domain.P7B.
      
      

2.  Right click on the certificate and select All Tasks -> Export option.
   

                               

3. The Certificate Export Wizard dialog pops up. Click Next button to proceed.
   

Commands to install certificates of some common vendors

Please find below the commands you need to use to install certificates of some common vendors.

NOTE: These instructions might change depending on the Certificates issued by the CA.

GoDaddy

If your CA is "GoDaddy", then the steps to follow will be:

keytool -import -alias root -keystore <Keystore_Name>.keystore -trustcacerts -file gd_bundle.crt

keytool -import -alias cross -keystore <Keystore_Name>.keystore -trustcacerts -file gd_cross_intermediate.crt

keytool -import -alias intermediate -keystore <Keystore_Name>.keystore -trustcacerts -file gd_intermediate.crt

keytool -import -alias <Alias Specified when creating the Keystore> -keystore <Keystore_Name>.keystore -trustcacerts -file <CertificateName>.crt

Verisign

If your CA is "Verisign", then the steps to follow will be:

keytool -import -alias intermediateCA -keystore <Keystore_Name>.keystore -trustcacerts -file <your_intermediate_certificate_name>.cer

keytool -import -alias <Alias Specified when creating the Keystore> -keystore < Keystore_Name>.keystore -trustcacerts -file <CertificateName>.cer

Comodos

If your CA is "Comodo", then the steps to follow will be:

keytool -import -trustcacerts -alias root -file AddTrustExternalCARoot.crt -keystore <Keystore_Name>.keystore

keytool -import -trustcacerts -alias addtrust -file UTNAddTrustServerCA.crt -keystore <Keystore_Name>.keystore

keytool -import -trustcacerts -alias ComodoUTNServer -file ComodoUTNServerCA.crt -keystore <Keystore_Name>.keystore

keytool -import -trustcacerts -alias essentialSSL -file essentialSSLCA.crt -keystore <Keystore_Name>.keystore

keytool -import -trustcacerts -alias <Alias Specified when creating the Keystore> -file <Certificate-Name>.crt -keystore <Keystore_Name>.keystore