Create SSL certificate for Web UI

Products

DSERIES- SERVER CA Workload Automation DE - System Agent (dSeries) CA Workload Automation DE CA Workload Automation DE - Scheduler (dSeries) CA Workload Automation DE - Business Agents (dSeries)

Issue/Introduction

Add a signed certificate to CA Workload Automation DE Web Client (Web UI). Using SSL connection is highly recommended when accessing the DE Web Client.

How to add a CA (Certificate Authority) signed certificate to CA WA DE Web Client?

Environment

CA Workload Automation DE R12 SP2 or above

CA Workload Automation DE Web Client R12 or above

Resolution

The DE Web Client is Apache-Tomcat application. You will use the keytool utility to create keystore and then generate a certificate.

Create a keystore

Answer all the questions that follow the keytool command. You will be prompted to enter keystore password. Be sure to remember or make a note of it. If you forget the password, you will not be able to access the keystore.

cd <de_web_ui_dir>/jre/bin
./keytool -genkey -alias alias_name -keyalg RSA -keystore your_keystore -keysize 2048

Note: Change the alias_name to your hostname or something unique. Aliases within the keystore must be unique. The keystore can be located anywhere as long as it is accessible. It is recommended to put the keystore in Web Client install directory.

E.g:

Linux
keytool -genkey -alias alias_name -keyalg RSA -keystore /opt/CA/WebUI/keystore -keysize 2048

Windows:
keytool -genkey -alias alias_name -keyalg RSA -keystore C:\CA\Web_Client/keystore -keysize 2048

Next generate the Customer Signing Request (CSR).

keytool -certreq -alias alias_name -file request.csr  -keystore your_keystore

This will generate the CSR. Submit the CSR to CA (Certificate Authority) for signing. The CA will sign the certificate and may provide root, intermediate and public certificate. They may also provide instructions on how to import them. From your CA, download the PEM encoded certificate with chain.

Example:

keytool -import -trustcacerts -alias root -file ca_root.crt -keystore your_keystore
keytool -import -trustcacerts -alias intermediate -file ca_Intermediate.crt -keystore your_keystore
keytool -import -trustcacerts -alias alias_name -file domain.com.crt -keystore your_keystore

Note: The alias_name in above command must be the same from "keytool -certreq command.

Add the CA Signed certificate to Apache-Tomcat (Web UI). Navigate to install directory and then to apache-tomcat/conf

cd <DE_WebUI_dir>/apache-tomcat/conf

Edit the file “server.xml”, and find this code:

<Connector port="8443" protocol="HTTP/1.1"

Under the connector port section, look for:

keyAlias=alias_name

keystoreFile="/<path>/keystore"

keystorePass="somepass"

Change the keyAlias name to what was used when generating the certificate. The alias name must match. The path to keystore file must be correct. Provide the same password that was used when the keystore was created. Usual default password is 'changeit'.

Save the ‘server.xml’, and then restart the DE Web UI. In your browser visit

https://host.example.com:8443/deui/login/#/

If successful, the browser address bar will display a safety lock sign.

Additional Information

If updating or replacing a certificate, but want to keep same alias, then older certificate must be delete.

keytool -delete -alias alias_name -keystore your_keystore

Then, add the new certificate using the same alias name as before.

keytool -import -trustcacerts -alias alias_name -file domain.com.crt -keystore your_keystore