Add your own certificate when configuring CCI SSL for OM Web Viewer 12.1 for USS

Products

• Output Management Web Viewer

Issue/Introduction

How to use your own certificate when setting up OM Web Viewer 12.1 for CCISSL.

Environment

• Output Management Web Viewer 12.1 for USS
• Common Components and Services for z/OS 

Resolution

Putting the certificate in the keystore:

1. Assuming 'DIGICERT.CAICCI.XXXXXXX' is a certificate in a format that the Java keystore program uses.
2. On OMVS, create a temporary work folder. For example:
     mkdir $HOME/keystore
3. FTP 'DIGICERT.CAICCI.XXXXXXX' using binary transfer to OMVS file $HOME/keystore/ccicert where ccicert will be the file - you can name this whatever you want.
4. On OMVS, ensure Java (${JAVA_HOME/bin) is in your path (for your session) - this should contain the "keytool" program. Note: It should already be there.
5. Set your current directory to the one containing the just FTP'd certificate file. For example:
     cd $HOME/keystore
6. Issue command:
     keytool -importcert -file $HOME/keystore/ccicert –keystore $HOME/keystore/cci.jks
7. When prompted for a password, enter the certificate's password.
8. When prompted to trust this certificate, respond "yes"
9. Note: If you also have a "Client End User Certificate", you will need to import that into the same keystore file.
10. When done, there should be a file named "cci.jks" in your temporary work folder. Note the full path to this file as well as the certificate password   (same password used to secure the keystore file).

Running the Web Viewer configtool to specify the location of the certificate.

1. Run the configtool
2.  Select your configuration type
3. Select "1: CCI Settings"
4. When prompted for "CCISSL: SSL connection", select either 2 (defer) or 3 (force).
5. When prompted for "CCISSL: Encryption Keystore", enter the full path to the keystore file created above. For example:
     $HOME/keystore/cci.jks
6. When prompted for a password, enter the keystore (same as certificate) password.
7. Respond to the remaining questions.
8.  When prompted, test the connection.
9.  Save the changes.
10.  If Tomcat is active, stop/start it to ensure setting changes are all picked up.