Defining the security certificate

By default, IBM Operational Decision Manager is delivered with self-signed certificates. You can replace the default certificates with your own certificates, either CA signed or self-signed. You do so with certificate tools such as OCP native certificate management capabilities External link opens a new window or tab or cert-manager External link opens a new window or tab, or with the Java™ keytool.

About this task

To enable a TLS connection, the web server needs to have a certificate so that clients can trust the authenticity of the web application. The default self-signed certificate is a certificate for testing purposes or internal usage as it is self-signed rather than signed by a trusted certificate authority (CA).

If the Operational Decision Manager release is deployed on OpenShift®, you might want to use the certificate (tls.key/tls.crt) exposed by OCP and embedded in the router-certs-default secret of the openshift-ingress project. For more information, see https://docs.openshift.com/container-platform/4.9/security/certificates/replacing-default-ingress-certificate.html External link opens a new window or tab.

Procedure

  1. Optional: Create a Kubernetes secret for the certificate files and the associated passwords.

    To create a Kubernetes secret, you must enter four parameters.

    • keystore_password: (optional) The password of the keystore. If not provided, the default is changeme.
    • tls.key: The name of the private key in PEM format.
    • truststore_password: (optional) The password of the truststore. If not provided, the default is changeme.
    • tls.crt: The name of the public key in PEM format.
    The following example shows how to create a Kubernetes secret:
    kubectl create secret generic mysecuritysecret --from-literal=keystore_password=keystorePwd --from-file=tls.key=<PATH_TO_LOCAL_PRIVATE_KEY>/tls.key --from-literal=truststore_password=truststorePwd --from-file=tls.crt=<PATH_TO_LOCAL_PUBLIC_KEY>/tls.crt

    Where mysecuritysecret is the name you give to the secret; keystorePwd and truststorePwd are the passwords.

    Note: JKS format remains supported. To use it, replace tls.key with keystore.jks, and tls.crt with truststore.jks.
  2. Required: Make a note of the name of your secret (mysecuritysecret) so that it is at hand when you enter it in the customization.securitySecretRef configuration parameter. You must enter the secret when you install ODM for production.