SM-UCMDB SSL Integration Issue
I'm trying to integrate SM 9.31 with ucmdb 10.01 using SSL, but I'm getting an error as per the attachment log.
I have done the following Configuration:
Adapter : service manager 9.x
Host name: Server name
Url override: https://servername:13443/SC62server/ws
Cerdential: username and passsword created in ucmdb same as falcon
The certificates are distributed in the followin locations
Adding the Ucmdb certificate(.cer) and SM Certificate (.cer) signed by CA to trustedclients.jks
Adding the Ucmdb certificate(.cer) and SM Certificate (.cer) signed by CA to HPProbetruststore.jks
Adding the SM Certificate (.cer) signed by CA to Server.truststore
Thanks and Regards
Actually I'm using only the server Certificate signed by CA for all because as per the documents nowhere is mentioned that you have to use also the client certificate for integration.
In your case keep the the UCMDB probe configuration as it is. But for SM and UCMDB Server add the UCMDB probe Server Certificate instead of Client.
Please try it and keep me posted.
Thanks and Regards
I got mine to work.
My fix was to copy a cacerts file which contained the SM Server certificate into the Data Flow Probe's JRE security store (<Probe Install Directory>/bin/jre/lib/security/conf/cacerts). I used the one generated by the SM certificate batch jobs.
I decided to use client Certificates for the data flow probe because the integration had to access the SM application server directly in the same way that the webtier and windows client. I treated the Probe as another client that needed to be verified by SM and distributed certificates per the SM SSL guides (each client received a copy of the cacerts containing the server certificate and a keystore that included the SM client certificate).
I also imported all of the SM certificates into the probe trust store for good measure, though in a client environment I was able to achieve the same results by just replacing the probe cacerts file.
So my resulting setup:
SM Client ceriticates in the trustedclients.keystore - as per the SSL setup
UCMDB Probe Client certificates in trustedclients.keystore - effect unknown
SM Client & Server certificates in hpprobetruststore.jks - resulted in bad certificate/invalid signature errors, but it was connecting
UCMDB Server certificates in hpprobetruststore.jks - mutual ssl with ucmdb
SM Client certificate in client.keystore - no noticable effect
CACerts with SM Server Certificates in /bin/jre/lib/security/ - managed to connect and integrate
Probe Client Certificate - mutual ssl with Probe
I have yet to try the API actual state integration between UCMDB and SM, but this worked for me.
I'm glad to hear that your problem has been solved.
I think your setup should be applied exactly the same to my environment but nowadays I'm too busy with other projects.
I think we can mark your result as the accepted solution but first let me test it.
Thanks for sharing your result with me.
To be specific, import the mycacert.pem generated by the SM server certificate batch file into the cacerts of the JRE in the Data Flow Probe responsible for the integration, not the native system cacerts found in the java keystore. The goal is to insert the root certificate used by SSL into the DFP's jre. In your case, try placing your signed CA certificate there first before inserting the other certificates into the keystores.
I suspect that this may be the only thing you need to do, as I was able to achieve the same result in a client dev environment by just placing a modified cacerts file (that contained their own verified certs) into a data probe's JRE. Please let me know how this method works.
Where is the trustedclients.keystore file kept on the SM server? The online doc says it is in the Java SDK directory but I don't find sdk only jre.