Installing a trusted certificate on an IBM Storage Protect server

Data that is transferred between a Lightweight Directory Access Protocol (LDAP) server and an IBM Storage Protect server must be encrypted by using the Transport Layer Security (TLS) protocol. To enable secure communications, you must install the trusted certificate from the LDAP server on the IBM Storage Protect server. The trusted certificate is verified during TLS communication.

1. If the LDAP server does not have access to the internet, turn off the feature for automatically updating root certificates, which is provided by Microsoft Windows Update.
   Tip: By completing this step, you prevent the LDAP server from attempting to obtain updates. Repeated attempts delay services.
2. Synchronize the system times of the IBM Storage Protect server and the Active Directory system on the LDAP server. You can use a Network Time Protocol server.
   • For instructions about synchronizing system times on the IBM Storage Protect server, see the documentation for the operating system that is used by the server.
   • For instructions about synchronizing the Active Directory system, see the Active Directory documentation.
3. Set up TLS for LDAP server connections. For instructions, go to the Microsoft website and search for LDAP and SSL. Take the following actions:
   1. Obtain a signed certificate. Active Directory requires that a signed certificate is in the Windows certificate store to enable TLS. Obtain a signed certificate by taking either of the following actions:
      • Obtain the certificate from a third-party certificate authority (CA).
      • Install the Certificate Services role on a system that is joined to the Active Directory domain and configure an enterprise root CA.
        Restriction: Do not install the Certificate Services role on the Active Directory server. Some Active Directory Domain configurations are not suited to accept an installed Certificate Services role. For example, the configuration is not suited if multiple Active Directory servers exist in a domain.
   2. Add the signed certificate to the Windows certificate store on the Active Directory server.
4. Determine whether the IBM Storage Protect server trusts the CA. As the instance owner from the server instance directory, issue the following command:

   gsk8capicmd_64 -cert -list -db cert.kdb -stashed
   gsk8capicmd_64 -cert -details -label "My_CA" -db cert.kdb -stashed

   where "My_CA" specifies the label of the CA certificate.
5. If the CA is not trusted, obtain the CA certificate from the certificate authority website.
   You can select either a Distinguished Encoding Rules (DER) binary file or a Base64-encoded ASCII file.

   Tip: To determine whether the file is DER binary or ASCII, open the certificate in a text editor. If you can read the characters, the file is an ASCII file.

   Ensure that you have the root certificate and that the subject on the certificate matches the CA name. The Issued by and Issued to/subject for the root certificate must be the same.

   Export the CA certificate by using one of the following methods:

   • Export the CA certificate from the Certificates (Local Computer) section of the Microsoft Management Console snap-in.
   • Copy the certificate from the C:\Windows\system32\certsrv\CertEnroll\*.crt file. The file is in DER binary format.
   • If the certificate is enabled by the Certificate Enrollment Web Services, download the CA certificate file from the Certificate Services web interface:

     http://<certificate_server_hostname>/certsrv/

     where <certificate_server_hostname> is the host name of the certificate server.
6. Copy the CA certificate to the IBM Storage Protect server instance directory.
7. Add the CA certificate to the IBM Storage Protect server key database. From the IBM Storage Protect server, as the instance user from the instance directory, issue the appropriate command. The command is similar to the following example:

   gsk8capicmd_64 -cert -add -db "cert.kdb" -stashed 
   -label "My CA" -format ascii -file myca.cer -trust enable

   1. List all the certificates in cert.kdb using the following command:

      gsk8capicmd_64 -cert -list -db cert.kdb -stashed

      Example output:

      Certificates found
      * default, - personal, ! trusted, # secret key
      !    "SP Root CA Cert"
      !    "SP Intermediate CA Cert"
      !    vcloud688.storage.tucson.ibm.com:1500:0
      *-   “MyServerCertificate”

      where MyServerCertificate is the host certificate.

   2. Export the signed certificate to PKCS12 format to enable communication with the Operations Center.
      Note: Complete this step only on the hub server where the Operations Center is configured.

      gsk8capicmd_64 -cert -export -db cert.kdb -stashed -label 
      "MyServerCertificate" -type pkcs12 -target certp12.p12 -target_pw truststore_password

      gsk8capicmd_64 -cert -rename -db certp12.p12 -pw truststore_password -label 
      "MyServerCertificate" -new_label "TSMServerSelfSignedSHAKey"

      where truststore_password is the password provided for the PKCS12 certificate.

      Note: The new_label parameter should have the value TSMServerSelfSignedSHAKey. It should not be changed.

   To encode the password and store it on your local system for secure reuse in future operations, run the following commands.

   • Linux:

     echo 'truststore_password' | base64 > certp12.pwd

   • AIX

     echo "truststore_password" | openssl base64

   • Windows:

     echo|set /p=truststore_password > input.txt
     certutil -encode input.txt tmp.txt
     findstr /v CERTIFICATE tmp.txt > certp12.pwd
     del input.txt tmp.txt

   where truststore_password is the password of the PKCSA12 truststore (certp12.p12).

8. Set File permissions for the newly created PKCS12 truststore by issuing the following command:

   chmod 777 certp12.p12 certp12.pwd

9. Validate the certificate chain in the IBM Storage Protect key database by using GSKit. Issue the following command from the IBM Storage Protect server as the instance user from the instance directory:

   gsk8capicmd_64 -cert -validate -db cert.kdb -stashed -label certificate_label

   where certificate_label is the label on the LDAP server certificate.