Configuring IBM Content Navigator Sync SSL for a container environment

To configure IBM® Content Navigator Sync SSL in a container environment, you must configure the IBM Content Navigator container with new keystores.

To configure the IBM Content Navigator container SSL with new keystores, complete the following steps:

Create the server certificate keystore for IBM Content Navigator.

The IBM Content Navigator container Java Development Kit is 1.8.0_181. Use the same Java Development Kit version to create the key:

keytool -genkey -v -keyalg RSA -alias <icn_server_alias> -keypass <_key_password>
-keystore <keystore_name> -storepass <store_password> -validity <valid_days> -dname
"<dname_for_ICN>" -sigalg SHA256withRSA

Example:

keytool -genkey -v -keyalg RSA -sigalg SHA256withRSA -alias icp-icn -keypass changeit
-keystore mykey0.jks -storepass changeit -validity 3650 -dname
"CN= icp-master-1.fyre.ibm.com, OU=Unknown, O=IBM, L=Unknown, ST=Unknown, C=Unknown"

Ensure that the IdP server and the IBM Content Navigator container support the sigalg type Export certs from the key created in the example:

keytool -export -alias <alias_name> -keystore <keystore_name> -file <cert_file_name> -storepass <keystore_password>

Example:

keytool -export -alias icp-icn -keystore mykey0.jks -file mykey0.cer -storepass changeit

Create the trustkey store for the server:

keytool -keystore <trust_keystore_name> -alias <keystore_alias> -import -file
 <cert_file_name> -storepass <keystore_password>

Example:

keytool -keystore mytruststore0.jks -alias icp-icn -import -file mykey0.cer 
-storepass changeit

For Java Development Kit versions equal to or earlier than 1.8, use the following:

keytool -genkey -v -keyalg RSA -sigalg SHA256withRSA  -alias icp-icn -keypass changeit -keystore
  mykey3.jks  -storepass changeit -validity 3650 -dname "CN=icn-host , OU=ECM, O=IBM, L=Unknown, ST=Unknown, C=Unknown" 
keytool -export -alias icp-icn  -keystore mykey3.jks -file mykey3.cer -storepass changeit
keytool -keystore mytruststore3.jks -alias  icp-icn  -import -file  mykey3.cer -storepass changeit

For Java Development Kit version 1.8, use the following:

keytool -genkeypair -v -keyalg RSA -sigalg SHA256withRSA  -alias icp-icn -keypass changeit -keystore
 mykey3.jks  -storepass changeit -validity 3650 -dname "CN=icn-host , OU=ECM, O=IBM, L=Unknown, ST=Unknown, C=Unknown" 
keytool -exportcert -alias icp-icn  -keystore mykey3.jks -file mykey4.cer -storepass changeit
keytool -importcert -keystore mytruststore4.jks -alias  icp-icn  -file  mykey4.cer -storepass changeit

keytool -list -v -keystore mykey3.jks  -storepass changeit

keytool -list -v -keystore mytruststore3.jks  -storepass changeit

Overwrite the IBM Content Navigator container SSL setting with the two keystores. Create an SSL overwrite file with the keys created in the previous step.

Example SSL overwrite file:

<sslDefault sslRef="icnSSLSettings" />
        <ssl id="icnSSLSettings"   
        keyStoreRef="icnKeyStore" 
        trustStoreRef="icnTrustStore"  
        clientAuthenticationSupported="false"   
/>   
        <keyStore id="icnKeyStore"

location="/opt/ibm/wlp/usr/servers/defaultServer/configDropins/overrides/mykey2.jks"
        type="JKS" password="changeit" 
        />
       <keyStore id="icnTrustStore"

location="/opt/ibm/wlp/usr/servers/defaultServer/configDropins/overrides/mytruststore2.jks"
      type="JKS" password="changeit" 
/>

Ensure that you set the ownership on the SSL files to 50001:50000.

SSL certificate validation for sync service calls

SSL certificate validation is enforced by default when IBM Content Navigator communicates with the Sync service. If the Sync service SSL certificate is not present in the IBM Content Navigator server trust store, requests to the Sync service fails and SSL validation errors will appear in the logs.

To resolve this issue, either add the Sync service SSL certificate to the IBM Content Navigator JVM trust store (recommended) or set the following Java Virtual Machine property and restart the server to bypass SSL validation:

-Dcom.ibm.ecm.icn.sync.ignoreSyncServiceSSLCertificateValidation=true

Note: Use this property only in non-production environments where adding the certificate is not immediately possible.