-
Title
How to Upload/Replace the Certificate Used for the Management Console for Unix (MCU) Within Jetty on Windows -
Description
A certificate needs to be uploaded for the first time or replaced within Jetty for the MCU.
-
Cause
A valid and non-expired certificate is required for the MCU to function as expected. -
Resolution
Please ensure the certificate to be used within the MCU is in .pfx format before continuing.
The .pfx format will include the certificate, public key, and private key together which is crucial to creating the keystore certificate for the MCU.
For assistance creating a self-signed .pfx certificate to use within the MCU please see the following KB article:
How To Create a Self Signed Certificate for Management Console for Unix (MCU) on Windows
Additionally, please ensure the latest Java release has been downloaded and installed (if not installed already)
The latest version of Java can be found by clicking on this text.
Start by running the following command to export the .pfx certificate to the keystore file required:"C:\Program Files\Java\JRE_RELEASE\bin\keytool.exe" -importkeystore -srckeystore \PATH\TO\CERTIFICATE.PFX -srcstoretype PKCS12 -destkeystore keystoreNOTE 1 - Please change JRE_RELEASE to the folder with the jre release number pertinent to the JRE version installed.NOTE 2 - Please replace the \PATH\TO\CERTIFICATE.PFX with the path to the certificate in .pfx format.Now that the keystore file has been created please backup, and then overwrite, the keystore file with this new keystore file which can be located at:
C:\ProgramData\Quest Software\Management Console for Unix\jetty-base\etc\keystore
Once the above file is replaced please edit the custom.cfg file with the password for this keystore.
The custom.cfg can be found here:C:\ProgramData\Quest Software\Management Console for Unix\resources\custom.cfg
The 3 lines which need the password updated are as follows:-Djetty.sslContext.keyStorePassword=KEYSTORE_PASSWORD_HERE -Djetty.sslContext.keyManagerPassword=KEYSTORE_PASSWORD_HERE -Djetty.sslContext.trustStorePassword=KEYSTORE_PASSWORD_HERENOTE 1 - Please replace KEYSTORE_PASSWORD_HERE in all 3 lines with the password for the keystore that was set upon creation. These can be in clear text, obfuscation, checksum or they can be encrypted. See jetty documentation for help on securing passwords.NOTE 2 - If the Keystore password is obfuscated, the field should be in the format:-Djetty.sslContext.keyStorePassword=OBF:OBFUSCATION_HERE -Djetty.sslContext.keyManagerPassword=OBF:OBFUSCATION_HERE -Djetty.sslContext.trustStorePassword=OBF:OBFUSCATION_HEREAn example of this would like the following:-Djetty.sslContext.keyStorePassword=OBF:1wm34wvn2hbi2n8j2w843pes2whv1qu0 -Djetty.sslContext.keyManagerPassword=OBF:1wm34wvn2hbi2n8j2w843pes2whv1qu0 -Djetty.sslContext.trustStorePassword=OBF:1wm34wvn2hbi2n8j2w843pes2whv1qu0
Once done, save the custom.cfs and restart the One Identity Management Console for Unix service or reboot the host. The new certificate should now be in use.