SSL Configuration steps for Version 12.3
SSL Configuration
Note: Please don't modify the OpManager.truststore file. For third party certificates use OpManagerServer.truststore file. Also don't delete the OpManager.truststore file, it should be available in conf directory.
-------------------------------------------------------------------------------------------------------------------
Prerequisites:
Build number should be greater than or equals to 12300
For PPM Customers (12200-12300): Extract this zip under the Home directory & then proceed the below.
Also make sure the below file exists in home/server_xml_bkp directory
win_ssl_server.xml
-------------------------------------------------------------------------------------------------------------------
Installing .PFX certificate in OpManager:
First Enable SSL & then install .PFX certificate.
To Enable SSL, Please follow the below steps.
- Open a command prompt and change directory to /opmanager/bin.
- Execute the following command,
ssl_gen.bat/sh -f Enable
To install the .PFX certificate, please follow the steps below.
1. First you need to convert the .pfx type to .truststore type. To do that, place the .pfx file under \OpManager\jre\bin folder. Also open a command prompt as Administrator and go to \OpManager\jre\bin folder.
2. Run the command below with the correct .pfx file.
keytool.exe -importkeystore -srckeystore mykeystore.pfx -destkeystore OpManagerServer.truststore -srcstoretype pkcs12 -deststoretype JKS
It will ask you for a password, please use the pfx password as the truststore password.
3. OpManagerServer.truststore file will be generated after running the above command under \OpManager\jre\bin folder, place this file under \OpManager\conf folder.
4. Now we have to configure Tomcat, for that, open "server.xml" file (under OpManager_Home\conf) in a text editor.
For Linux:
Search for term "keystoreFile". It will be an attribute for connector tag. And set the value as "./conf/OpManagerServer.truststore". Change the value for "keystorePass" attribute with your keystore file password.
For Windows:
Search for term "certificateKeystoreFile". It will be an attribute for connector tag. And set the value as "./conf/OpManagerServer.truststore". Change the value for "certificateKeystorePassword" attribute with your keystore file password.
5. Start OpManager.
-------------------------------------------------------------------------------------------------------------------
Enabling third party SSL:
First Enable SSL & then enable third party certificate.
To Enable SSL, Please follow the below steps.
- Open a command prompt and change directory to /opmanager/bin.
- Execute the following command,
ssl_gen.bat/sh -f Enable
To install the third party certificate, please follow the steps below.
1.Open the command prompt and change to OpManager_Home directory.
2. Generating keystore file:
Execute the following command and provide requested details to create OpManagerServer.truststore file under conf folder.
>jre\bin\keytool.exe -v -genkey -keyalg RSA -keystore conf\OpManagerServer.truststore -alias opmanager (Press Enter)
( or )
>jre\bin\keytool.exe -v -genkey -keyalg RSA -keystore conf\OpManagerServer.truststore -alias opmanager -keysize 2048 for 2048 bit key
Enter keystore password:(Enter a password for this keystore. atleast 6 characters long. Press Enter)
What is your first and last name?
[Unknown]: (Enter the Server's name in which OpManager is running. It must be a FQDN
[Fully Qualified Domain Name] Ex.: opmserver.manageengine.com. Press Enter.)
What is the name of your organizational unit?
[Unknown]: (Name of your Orgazational Unit. Ex: SYSADMIN. Press Enter.)
What is the name of your organization?
[Unknown]: (Your Organization Name. Ex:Zoho Corp. Press Enter.)
What is the name of your City or Locality?
[Unknown]: (Your city name. Ex:Pleasanton. Press Enter.)
What is the name of your State or Province?
[Unknown]: (Your state name. Ex:California. Press Enter.)
What is the two-letter country code for this unit?
[Unknown]: (Your country's two letter code. Ex:US. Press Enter.)
Is CN=opmserver.manageengine.com, OU=SYSADMIN, O=Zoho Corp, L=Pleasanton,
ST=California, C=US correct?
[no]: (Check the details and if it is correct type yes and press enter. If else just press Enter to
modify)
Generating 1,024 bit RSA key pair and self-signed certificate (MD5WithRSA)
for CN=opmserver.manageengine.com, OU=SYSADMIN, O=Zoho Corp, L=Pleasanton,
ST=California, C=US
Enter key password for <opmanager>
(RETURN if same as keystore password): (Just press enter. For tomcat both keystore password and key [alias] password must be the same)
[Storing conf\OpManagerServer.truststore]
3. Generating CSR File (Certificate Signing Request):
Execute the following commands to create opmssl.csr file under conf folder.
>jre\bin\keytool.exe -v -certreq -file conf\opmssl.csr -keystore conf\OpManagerServer.truststore -alias opmanager
Enter keystore password: (Enter the password for the keystore file)
Certification request stored in file <conf\opmssl.csr>
Submit this to your CA
4. Getting certificates from CA (Certification Authority):
Contact a CA like Verisign, Equifax, with the csr file generated in the previous step to get ssl certificate.
2. Generating keystore file:
Execute the following command and provide requested details to create OpManagerServer.truststore file under conf folder.
>jre\bin\keytool.exe -v -genkey -keyalg RSA -keystore conf\OpManagerServer.truststore -alias opmanager (Press Enter)
( or )
>jre\bin\keytool.exe -v -genkey -keyalg RSA -keystore conf\OpManagerServer.truststore -alias opmanager -keysize 2048 for 2048 bit key
Enter keystore password:(Enter a password for this keystore. atleast 6 characters long. Press Enter)
What is your first and last name?
[Unknown]: (Enter the Server's name in which OpManager is running. It must be a FQDN
[Fully Qualified Domain Name] Ex.: opmserver.manageengine.com. Press Enter.)
What is the name of your organizational unit?
[Unknown]: (Name of your Orgazational Unit. Ex: SYSADMIN. Press Enter.)
What is the name of your organization?
[Unknown]: (Your Organization Name. Ex:Zoho Corp. Press Enter.)
What is the name of your City or Locality?
[Unknown]: (Your city name. Ex:Pleasanton. Press Enter.)
What is the name of your State or Province?
[Unknown]: (Your state name. Ex:California. Press Enter.)
What is the two-letter country code for this unit?
[Unknown]: (Your country's two letter code. Ex:US. Press Enter.)
Is CN=opmserver.manageengine.com, OU=SYSADMIN, O=Zoho Corp, L=Pleasanton,
ST=California, C=US correct?
[no]: (Check the details and if it is correct type yes and press enter. If else just press Enter to
modify)
Generating 1,024 bit RSA key pair and self-signed certificate (MD5WithRSA)
for CN=opmserver.manageengine.com, OU=SYSADMIN, O=Zoho Corp, L=Pleasanton,
ST=California, C=US
Enter key password for <opmanager>
(RETURN if same as keystore password): (Just press enter. For tomcat both keystore password and key [alias] password must be the same)
[Storing conf\OpManagerServer.truststore]
3. Generating CSR File (Certificate Signing Request):
Execute the following commands to create opmssl.csr file under conf folder.
>jre\bin\keytool.exe -v -certreq -file conf\opmssl.csr -keystore conf\OpManagerServer.truststore -alias opmanager
Enter keystore password: (Enter the password for the keystore file)
Certification request stored in file <conf\opmssl.csr>
Submit this to your CA
4. Getting certificates from CA (Certification Authority):
Contact a CA like Verisign, Equifax, with the csr file generated in the previous step to get ssl certificate.
Mostly you have to copy and paste the content of the csr file in a text area of theier website. After verifying your request, mostly they will sent you the certficate content through mail. Copy and paste the content in a text editor and save it as "ServerCert.cer" under OpManager_Home\conf folder. Be cautious that while doing copy-paste, no extra space added at the end of lines.
5. Importing root and intermediate certifacates:Before importing our certificate, we have to import the CA's root and intermediate certificates into the keystore file we generated at the second step. While mailing you the certificate, CA's will mention the link to their root and intermediate certificates. Save them under conf directory in the name
"CARoot.cer" and "CAIntermediate.cer" respectively. Some CAs may have two or more intermediate certificates.
"CARoot.cer" and "CAIntermediate.cer" respectively. Some CAs may have two or more intermediate certificates.
Refer their document clearly before importing.
To import root certificate:
(Execute it from OpManager home directory)
>jre\bin\keytool.exe -import -trustcacerts -file conf\CARoot.cer -keystore conf\OpManagerServer.truststore -alias CARootCert
Enter keystore password: (Enter the keystore password)
(Root Certifiate's information will be printed)
Trust this certificate? [no]: (type yes and press enter if it is the certificate of your CA)
Certificate was added to keystore
To import Intermediate certificate:
>jre\bin\keytool.exe -import -trustcacerts -file conf\CARoot.cer -keystore conf\OpManagerServer.truststore -alias CARootCert
Enter keystore password: (Enter the keystore password)
(Root Certifiate's information will be printed)
Trust this certificate? [no]: (type yes and press enter if it is the certificate of your CA)
Certificate was added to keystore
To import Intermediate certificate:
(Execute it from OpManager home directory)
>jre\bin\keytool.exe -import -trustcacerts -file conf\CAIntermediate.cer -keystore conf\OpManagerServer.truststore -alias CAInterCert
Enter keystore password: (Enter the keystore password)
Certificate was added to keystore
6. Importing Server's Certificate:
Execute the follwing command to add the certificate received from CA to the keystore file.
>jre\bin\keytool.exe -import -trustcacerts -file conf\CAIntermediate.cer -keystore conf\OpManagerServer.truststore -alias CAInterCert
Enter keystore password: (Enter the keystore password)
Certificate was added to keystore
6. Importing Server's Certificate:
Execute the follwing command to add the certificate received from CA to the keystore file.
(Execute it from OpManager home directory)
>jre\bin\keytool.exe -import -trustcacerts -file conf\ServerCert.cer -keystore conf\OpManagerServer.truststore -alias opmanager
Enter keystore password: (Enter the keystore password)
Certificate reply was installed in keystore
7. Now we have to configure Tomcat, for that, open "server.xml" file (under OpManager_Home\conf) in a text editor.
>jre\bin\keytool.exe -import -trustcacerts -file conf\ServerCert.cer -keystore conf\OpManagerServer.truststore -alias opmanager
Enter keystore password: (Enter the keystore password)
Certificate reply was installed in keystore
7. Now we have to configure Tomcat, for that, open "server.xml" file (under OpManager_Home\conf) in a text editor.
For Linux:
Search for term "keystoreFile". It will be an attribute for connector tag. And set the value as "./conf/OpManagerServer.truststore". Change the value for "keystorePass" attribute with your keystore file password.
For Windows:
Search for term "certificateKeystoreFile". It will be an attribute for connector tag. And set the value as "./conf/OpManagerServer.truststore". Change the value for "certificateKeystorePassword" attribute with your keystore file password.
9. Start OpManager server. Connect client with https. Ex:https://opmserver.manageengine.com:80
Note:If you are already having a certificate for this server and that certificate was requested by the keystore
file generated using Java keytool, you may use it for SSL configuration. Just copy and paste the keystore file under OpManager_Home\conf and rename it to “OpManagerServer.truststore” and follow the steps from 5.
file generated using Java keytool, you may use it for SSL configuration. Just copy and paste the keystore file under OpManager_Home\conf and rename it to “OpManagerServer.truststore” and follow the steps from 5.
New to ADSelfService Plus?
Related Articles
Enabling SSL using .PFX certificate in OpManager version 12
Steps to enable SSL using .Pfx certificate 1. First you need to convert the .pfx type to .truststore type. Place your .pfx certificate in \OpManager\jre\bin\ folder. To do that, open a command prompt as an Administrator and go to \OpManager\jre\bin ...Steps to Enable Telnet and RDP options in Browsers to use with Opmanager
Steps to Enable Telnet and RDP options in Browsers to use with OpManager Enabling Telnet and RDP protocols in browsers: There are some prerequisites that needs to be met based on the browsers you use to work with Remote Desktop and Telnet ...Device/Interface Name not populating in Traffic (NFA) Module for SNMP V3 - OpManager v12
Issue: Device/Interface Name not getting populated for N/w Devices monitored using SNMP V3 protocol OpManager v12. Analysis: When the device takes longer time to respond for the SNMP V3 requests, then the device name will not get populated in the ...How to get the URL in URL reports of Firewall Analyzer (Cisco ASA) ?
1. Log in to Cisco ASDM -> Device Management -> Configuration -> Logging Setup -> Enable the ID 304001 (HTTP Inspection) and make sure it is set to 'Informational'. 2. Go to Configuration -> Service Policy Rules. 3. Go to Edit -> Rule Actions -> ...In the Database Query monitor, how can I increase the number of rows that Applications Manager displays in a query ?
Question: How can I increase the number of rows that Applications Manager displays in a query?/ I get an error message that the query has more than 50 rows. What can I do? Solution: Here are the steps to customize the Query Monitor rows displayed ...