Configuring the Symantec Management Platform to use HTTP instead of SSL.

Products

• IT Management Suite

Issue/Introduction

The customer by mistake configured his Symantec Management Platform to use SSL (HTTPS) instead of the default HTTP protocol. Now, he wants to change to an HTTP configuration.

Environment

ITMS 8.x

Resolution

Configuring Notification Server to use HTTP after ITMS installation is completed as HTTPS

Notification Server is automatically configured to use HTTPS during the installation of IT Management Suite, when you select the Require HTTPS to access the Management Platform on the Notification Server Configuration page, in Symantec Installation Manager. However, if by mistake you selected  Require HTTPS to access the Management Platform and you don't want to configure your SMP to use this protocol and you want instead HTTP, you will need to review the following settings to revert back from HTTPS to HTTP.

The process of setting up HTTP communication in your ITMS environment involves the following steps:

Table: Process of setting up HTTP communication in your ITMS environment

Step	Action	Description
Step 1	Configure your Notification Server and Symantec Management Agents to use HTTP.	After the ITMS solutions installation is completed, a Notification Server communication profile is used to perform the following:   Configure your Notification Server for HTTP access. The default SSL port is 443. The port 443 and HTTPS access must be disabled. Configure your Symantec Management Agents to use HTTP for communicating with Notification Server. See Configuring a Notification Server communication profile
Step 2	Configure your  Targeted Agent Settings to use HTTP.	Verify that the HTTP option for the Server URL under the "Advanced" tab is pointing to the HTTP one on any active Targeted Agent Settings policy.
Step 3	Configure the Symantec Management Console to use HTTP only.	To configure the Symantec Management Console so that it is available to HTTP only, disable the IIS SSL setting Require SSL.
Step 4	Configure a package server to publish HTTP package codebases.	You can configure HTTP on your package servers by using the Package Service Settings page. This page specifies the global package service settings that are applied to all package servers that serve your Symantec Management Platform. If you had "Publish HTTPS codebase", Then go to Control Panel>Scheduled Tasks and run the NS.Package Refresh schedule (by default it runs everyday at 3:30am). By running this schedule, the SWD codebases and snapshot URLs should be updated.
Step 5	Configure site servers to use HTTP.	Check that you don't have "Configure HTTPs binding" under the "Global Site Server Settings" page. As well, check that the Site Server Communication Profile was not set to HTTPS.   (Only required for setting up Cloud-enabled Management) If you have CEM setup, you will need to maintain a mix environment since CEM doesn't work with plain HTTP. It requires HTTPS configuration under the Symantec Agent Site. To serve CEM agents, site servers have to be configured to use HTTPS. This process is automated by Cloud-enabled Management Site Server Settings policy. When a new site server is assigned to an Internet site, an SSL certificate is distributed and HTTPS binding is created on the 4726 (changeable) port. By default, Global Site Server Settings policy or Custom Certificate rollout settings do not affect the functionality of site servers that already use HTTPS. For example, if you assign a site server with an existing HTTPS binding to an Internet site, the binding is not overwritten. Configure sites and site servers to serve Cloud-enabled agents. (Only required for setting up Cloud-enabled Management) The Cloud-enabled agents that are behind the Internet gateway use Internet sites for determining site services. In the Symantec Management Console, you must add your site servers to a predefined Default Internet Site or other Internet sites that you want to use. You must also assign the Cloud-enabled computers to the sites that are based on resource targets. This manual assignment ensures that each computer remains a member of the appropriate site regardless of where it is physically located. See Configuring sites and site servers to serve cloud-enabled agents
Step 6	Configure Agent Install to use HTTP.	Verify that the available option for pushing the Symantec Management Agent is HTTP under the "Agent Install" page.
Step 7	Configure SIM to use HTTP.	Open Registry Editor (regedit.exe). Go to "HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\AIM\Configuration\NsConfiguration" and check that the "NsWebSitePort" is set from decimal "443" to "80". As well, under "NsWebSiteSSL" is set from "True" to "False"

Note: Other areas to review depending on how far ahead you are with respect to configuring your environment as HTTPS are:

1. If Persistent Connection was enabled. Enabling Persistent Connection in your Environment
2. If an Internet Site Server was setup and CEM is not in use, you will need to remove the assigned Site Server, if any.

Additional Information

179801 The Altiris line of products fully supports the use of SSL and HTTPS

180506 Configuring the Symantec Management Platform to use SSL.

237409 Configuring the Symantec Management Platform to use HTTPS (SSL) instead of HTTP.