SM-UCMDB SSL Integration Issue

Hi Experts,

 

I'm trying to integrate SM 9.31 with ucmdb 10.01 using SSL, but I'm getting an error as per the attachment log.

 

I have done the following Configuration:

 

Adapter : service manager 9.x

Host name: Server name

Port: 13443

Url override: https://servername:13443/SC62server/ws

Cerdential: username and passsword created in ucmdb same as falcon

 

The certificates are distributed in the followin locations

 

 

SM server:

Adding the Ucmdb certificate(.cer) and SM Certificate (.cer) signed by CA to trustedclients.jks

 

Probe server

Adding the Ucmdb certificate(.cer) and SM Certificate (.cer) signed by CA to HPProbetruststore.jks

 

UCMDB Server

Adding the SM Certificate (.cer) signed by CA to Server.truststore

 

Kindly advice

 

Thanks and Regards

 

Hani

 

 

Tags:

  • I'm having the same issue here after enabling SSL on the server. Could you clarify which kind of certficates have been loaded into where? So far I have the following certificates in place:

     

    SM:

    SM Client Certificates (x2, for client/webtier)

    UCMDB Probe Client certificate

     

    UCMDB Probe (located on the same server as SM):

    SM Server Certificate

    SM Client Certificate

    UCMDB Server Certificate

     

    UCMDB (UD10.01)

    UCMDB Probe Client Certificate

     

    Based on your previous posts, I believe I've made a little headway; it seems that loading the probe with a SM client certificate is the way to go, however my issue is that the certificate the probe is sending back to the SM server is invalid, despite using the same client certs (Which work) for the Client/webtier.

     

     

    jvm 1 | Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate

  • Hi Efsy,

     

    Actually I'm using only the server Certificate signed by CA for all because as per the documents nowhere is mentioned that you have to use also the client certificate for integration.

     

    In your case keep the the UCMDB probe configuration as it is. But for SM and UCMDB Server add the UCMDB probe Server Certificate instead of Client.

     

    Please try it and keep me posted.

     

    Thanks and Regards

     

    Hani

  • I got mine to work.

     

    My fix was to copy a cacerts file which contained the SM Server certificate into the Data Flow Probe's JRE security store (<Probe Install Directory>/bin/jre/lib/security/conf/cacerts). I used the one generated by the SM certificate batch jobs.

     

    I decided to use client Certificates for the data flow probe because the integration had to access the SM application server directly in the same way that the webtier and windows client. I treated the Probe as another client that needed to be verified by SM and distributed certificates per the SM SSL guides (each client received a copy of the cacerts containing the server certificate and a keystore that included the SM client certificate). 

     

    I also imported all of the SM certificates into the probe trust store for good measure, though in a client environment I was able to achieve the same results by just replacing the probe cacerts file. 

     

    So my resulting setup:

     

    SM:

    SM Client ceriticates in the trustedclients.keystore - as per the SSL setup

    UCMDB Probe Client certificates in trustedclients.keystore - effect unknown

     

    Probe:

    SM Client & Server certificates in hpprobetruststore.jks - resulted in bad certificate/invalid signature errors, but it was connecting

    UCMDB Server certificates in hpprobetruststore.jks - mutual ssl with ucmdb

    SM Client certificate in client.keystore - no noticable effect

    CACerts with SM Server Certificates in /bin/jre/lib/security/ - managed to connect and integrate

     

    UCMDB:

    Probe Client Certificate - mutual ssl with Probe

     

    I have yet to try the API actual state integration between UCMDB and SM, but this worked for me.

  • Hi Efsy,

     

    I'm glad to hear that your problem has been solved.

    I think your setup should be applied exactly the same to my environment but nowadays I'm too busy with other projects.

    I think we can mark your result as the accepted solution but first let me test it.

    Thanks for sharing your result with me.

     

    Regards

     

    Hani

  • To be specific, import the mycacert.pem generated by the SM server certificate batch file into the cacerts of the JRE in the Data Flow Probe responsible for the integration, not the native system cacerts found in the java keystore. The goal is to insert the root certificate used by SSL into the DFP's jre. In your case, try placing your signed CA certificate there first before inserting the other certificates into the keystores. 

     

    I suspect that this may be the only thing you need to do, as I was able to achieve the same result in a client dev environment by just placing a modified cacerts file (that contained their own verified certs) into a data probe's JRE. Please let me know how this method works.

     

    Good luck

  • Where is the trustedclients.keystore file kept on the SM server?   The online doc says it is in the Java SDK directory but I don't find sdk only jre.


  • In our case, the trustedclients.keystore is within the RUN directory.