SM-UCMDB SSL Integration Issue
I'm trying to integrate SM 9.31 with ucmdb 10.01 using SSL, but I'm getting an error as per the attachment log.
I have done the following Configuration:
Adapter : service manager 9.x
Host name: Server name
Url override: https://servername:13443/SC62server/ws
Cerdential: username and passsword created in ucmdb same as falcon
The certificates are distributed in the followin locations
Adding the Ucmdb certificate(.cer) and SM Certificate (.cer) signed by CA to trustedclients.jks
Adding the Ucmdb certificate(.cer) and SM Certificate (.cer) signed by CA to HPProbetruststore.jks
Adding the SM Certificate (.cer) signed by CA to Server.truststore
Thanks and Regards
Is this the first time with this integration?
Are you getting an error message on your screen?
What are you doing when you get that error message?
Thank you for your reply.
Actually yes it is the first integration. On the screen I'm getting the same error as per the attachment (PLS refer to the image below). When I get this error message, I tried many times to relocate the certificates since as per the logs it seems the issue something related to SSL. I didn't find any document explain exactly how to do this integration using CA certificate. I found only one document describes how to do it using Self signed certficate which is the the case that I have.
check the SM 9.31 - uCMDB 10 integration guide KM1195820 for detailed steps on how to configure it.
If you find this or other posts helpful, please do not forget to click the Kudo Star or to mark it as a Solution if you are the owner of the thread. Thanks 🙂
Thank you for your reply.
I've configured it exactly as per the document but with no success. There is nothing mentioned about how to place the certificates in sm and ucmdb servers to trust each other.
Did you have SSL enabled before just with SM? If not you could first try that before runing the intergation to make sure it works fine.
Ther is also a known issue but it seems to be related to ucmdb 9.3 as you can see here:
In case you first would like to setup SSL on the Service Manager side then you can check the following document:
yes SSL and trusted sign on is configured on sm. Also ssl is configured on ucmdb. By the way i have tried to enable the integration without ssl, it is working fine. the problem only occured when SSL is enabled.
Thanks and Regards
Thank you for your support.
I don't think this is related to what I'm doing since this integration is working on one of our customers. It was done by HP PS. But as I remember even HP PS at that time had asked for HP support to implement it. I already asked them but they don't remember the steps since this configuration is not done frequently.
your support is really appreciated
Thanks and Regards
I am not sure if this will help
but with the cacert issue
. Create a server key store.
Instructions for creating a server key store
- Open a command-line window on the computer or the system where the CommonStore Server is installed.
- Enter the following command, where servername is the name or IP address of the server for which you want to create the keystore:keytool -genkey -alias servername -validity 365 -keystore keystore.jks.
- Enter a password when prompted by this message:Enter keystore password:
- You are asked a number of questions. Type an answer, where necessary, and press Enter to see the next question. Note that the question for the first and the last name has to be answered with the name of the CommonStore Server as specified in SAP (transaction code OAC0). For example:What is your first and last name? [Unknown]:myserver.comWhat is the name of your organizational unit? [Unknown]:AccountingWhat is the name of your organization? [Unknown]:Dough InternationalWhat is the name of your City or Locality?[Unknown]:SpringfieldWhat is the name of your State or Province? [Unknown]:What is the two-letter country-code for this unit? [Unknown]:USIs <CN=myserver.com, OU=Accounting, O=Dough International,L=Springfield,ST=Unknown, C=US> correct? [no]:yesEnter key password for <servername> (Press Enter if you want to usethe same password as for the keystore)Important:
By following these instructions, you create a self-signed certificate. Users who connect to a CommonStore Server receive a warning when such a certificate is used. If you want to avoid these warnings, let a trusted certificate authority sign your certificate.
Another solution is to instruct your client users to add the certificate to their trusted certificates when they receive the warning.
- Turn on Secure Socket Layer (SSL) support in the server configuration profile (usually archint.ini) by specifying the SSL Web port. Use the SSL_WEBPORT keyword for this purpose, for example:SSL_WEBPORT 5590
- Specify the path and file name of the keystore on the CommonStore Server by using the KEYSTORE_FILE keyword, for example:KEYSTORE_FILE C:\ssl\keystore.jks
- Enter the password for the keystore. To do so, take these steps:
- Open a command-line window.
- Change to the instance directory of the CommonStore Server. This is the directory that the INSTANCEPATH keyword points to. Remember, the INSTANCEPATH keyword is set in the configuration profile for the CommonStore Server (usually archint.ini).
ExamplesAIX®, HP-UX, Linux /home/<cssapusr>/
where <cssapusr> is the ID of the user you created for the purpose of running instances of the CommonStore Server.Sun Solaris /export/home/<cssapusr>/
where <cssapusr> is the ID of the user you created for the purpose of running instances of the CommonStore Server.Windows C:\Program Files\IBM\CSSAP\Server\instance01
- Enter the following command:archpro -f keystore_passwd
- You are asked for the password. Enter it.
2. Creat CSR Certificate Signing Request
To create a new CSR or generate a renewal request while another certificate exists on your Web site, follow these steps:
- In the Microsoft Management Console (MMC), right-click the default Web site, click New, and then click Site.
- Create a new site and give it a temporary name.
- Right-click the new site, click Properties, click the Directory Security tab, and then click Server certificate.
- Select Create new certificate and follow the wizard to create a new CSR. When prompted, select Prepare the request now but send it later.
- Use the CSR that you just created to request a new certificate from the certificate authority (CA) that issued the original certificate.
NOTE: If you are renewing a VeriSign certificate, see the following Web site: Renew SSL Certificates
If you are unable to renew the certificate by using this Web site, you can reach VeriSign's renewal department at the following e-mail address or telephone numbers:
Technical Support: (877) 438-8776
Sales: (650) 429-3347
- When you receive the certificate from VeriSign or another third-party CA, save it to your hard drive. Remember the serial number of this certificate and where you save it.
- Right-click the temporary site that you created in step 2, click Properties, click the Directory Security tab, click Server certificate, and then click Next. Follow the wizard. When prompted, select Process the pending request.
- After the certificate has been installed, click OK, and then stop and start the Web site.
- Right-click the temporary site that you created in step 2, click Properties, click Directory Security, and then click Server certificate.
- Select Remove the current certificate and follow the wizard. This removes the certificate from IIS, but the certificate remains in the certificate store.
- Right-click the Web site that has the original server certificate installed (that is, the certificate that you are renewing or replacing), click Properties, click Directory Security, click Server certificate, and then select Replace the current certificate.
- Select the certificate that you just installed. If you see duplicate certificate names, make sure that you select the certificate that matches the serial number that you noted in step 6.
NOTE: The list of available certificates is populated from the personal certificate store, which is located under Certificates (Local Computer) in the MMC. To view the personal certificate store, add the Certificates snap-in for the Computer Accountto your MMC.
NOTE: If IIS does not display the new certificate, you may need to copy it from the personal certificate store that is located under Certificates - Current User in the MMC into the personal certificate store that is located under Certificates (Local Computer). To view the personal certificate store, add the Certificates snap-in for the User Account to your MMC.
3. Imported certificate into keystore.
Copy the text file that contains your server certificate to the directory that contains your keystore file and save it as certificate.p7.
If you find that this post or any post resolves your issue, please make sure to mark it as an accepted solution."
Thank you for your support.
This configuration is used specifically for IBM SAP. The command used is general but the other configuration like configuring SSL and other config doesn't exist in ucmdb or SM. Server keystore is already created and is working file since I'm able to access the ucmdb and SM using SSL. So the problem here where to distribute the certificates to make the integration work properly because if there is any problem in the certificate generated I'll will not be able to access neither UCMDB nor SM.
For example if I remove the root CA Certificate from c:\program files(x86)\HP\server manager 9.30\Server\Run\cacerts"
the SM will stop working. So this means the cacerts is working properly.
I'm having the same issue here after enabling SSL on the server. Could you clarify which kind of certficates have been loaded into where? So far I have the following certificates in place:
SM Client Certificates (x2, for client/webtier)
UCMDB Probe Client certificate
UCMDB Probe (located on the same server as SM):
SM Server Certificate
SM Client Certificate
UCMDB Server Certificate
UCMDB Probe Client Certificate
Based on your previous posts, I believe I've made a little headway; it seems that loading the probe with a SM client certificate is the way to go, however my issue is that the certificate the probe is sending back to the SM server is invalid, despite using the same client certs (Which work) for the Client/webtier.
jvm 1 | Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate