Replacing certificate for communication from metadata interchange agents to IBM InfoSphere metadata asset manager

About this task
The installation of InfoSphere metadata asset manager (IMAM) is distributed across multiple computers. Some components are installed on the services tier and other components are installed on the client tier. The services tier components use WebSphere Application Server and the client tier components use Apache Tomcat. To improve the security of the communication between the components in WebSphere Application Server and Apache Tomcat, IMAM uses SSL certificates to encrypt the communication between components running in WebSphere Application Server and Apache Tomcat.

The communication between components running in WebSphere Application Server and Apache Tomcat occurs in two directions. Each direction uses a separate certificate. This procedure describes how to replace the certificate used for the communication from Apache Tomcat to WebSphere Application Server. The instructions for replacing the certificate used for communication in the other direction are here.

Step 1: Update WebSphere Application Server

If you want to use a certificate signed by a certificate authority, you need to follow the steps in this section. Take following steps to generate your certificate request else there can be a problem to import the signed certificate into WebSphere Application Server.

1. Go to Security -> SSL Certificate and key management -> Key stores and certificates-> IISKeyStore -> Personal certificate requests -> New. When prompted, enter the information you want to be in your certificate. The key label must be “iiscert”.

3. Take the signed certificate from the certificate authority and import it into WebSphere Application Server. Thus, go to Security -> SSL Certificate and key management -> Key stores and certificates -> IISKeyStore -> Personal Certificates -> Receive from a certificate authority. When it prompts for the certificate information, enter the certificate file name and data type, then select "Apply" and then "Save."

To create a new self-signed certificate to use for the communication, take the following step:

1. Go to Security->SSL Certificate and key management->Key stores and certificates->IISKeyStore->Personal certificates->Create->Self-signed certificate. When prompted, enter the information for the certificate. The alias must be “iiscert.”

2. Extract a public certificate from the new certificate. Thus, go to Security -> SSL Certificate and key management -> Key stores and certificates -> IISKeyStore -> Personal Certificates -> Select "iiscert" -> Click extract. In the certificate name field, choose the location to save this certificate to (For example, c:\temp\iiscert.cer). Select “Base64-encoded ASCII data” as the data type.

3. Restart WebSphere Application Server.

These instructions need to be completed on each computer installed with metadata interchange agent. They also assume that InfoSphere Information Server was installed to the following directory: c:\IBM\InformationServer. If you installed it to a different directory, you need to adjust the directory names for your environment.

1. Copy the iiscert.cer file that was extracted from WebSphere Application Server onto the current computer.

 

2. Open a Windows command shell and set up your environment for modifying the truststore by running the following commands:

• cd C:\IBM\InformationServer\Clients\MetaBrokersAndBridges\web\conf
  SET PATH=C:\IBM\InformationServer\ASBNode\apps\jre\bin;%PATH%

3. Verify that “iiscert” and “dummy” are the only entries in imamtruststore.p12 by running the following command and examining the result.

• keytool -list -keystore imamtruststore.p12 -storetype pkcs12

  When you run this command, you are prompted for the truststore password. The default password is changeit. Following is the output and you can find two certificate entry and they are iiscert and dummy as shown here.

  Enter keystore password:

  Keystore type: pkcs12
  Keystore provider: IBMJCE
  
  Your keystore contains 2 entries
  
  iiscert, mmm dd, yyyy, trustedCertEntry,
  Certificate fingerprint (MD5): B6:D5:A0:C2:64:21:CE:00:25:17:51:E3:81:6C:C2:F2
  dummy, mmm dd, yyyy, keyEntry,
  Certificate fingerprint (MD5): 34:48:D5:F1:A1:F5:77:6A:A8:80:7A:76:79:C3:92:48
  
  Note: If you followed this procedure before, the "dummy" certificate might not be present. If there are any other entries in the truststore, then they are not available in your new imamtruststore.p12 truststore. If they are need, then you have to export them into your new imamtruststore.p12 file after this process is complete.

• This step creates a backup file of the old truststore file. The file imamtruststore_old.p12 can be removed once the procedure is completed successfully.

5. Import the certificate file from WebSphere Application Server into a new truststore file. To create a new truststore, so the password you specify becomes the password for the new truststore. If you use a password other than "changeit", the Tomcat server.xml file needs to be updated (see step 6).

• keytool -import -noprompt -alias iiscert -storetype pkcs12 -keystore imamtruststore.p12 -storepass NewPassword -file CertificateFile
  
  For example,
  
  keytool -import -noprompt -alias iiscert -storetype pkcs12 -keystore imamtruststore.p12 -storepass changeit -file c:\temp\iiscert.cer

6. If you decided to use a truststore password that was different than the previous truststore password (the default password is "changeit"), then you need to update the Tomcat server.xml file with the new password. If you are certain that the password for the imam truststore in the Tomcat server.xml file is still correct, then you can skip this step. The following steps explain this process.

a. Open a new Windows command shell and run the following command to encrypt your new password:

• c:\IBM\InformationServer\ASBNode\bin\encrypt.bat
  
  It prompts you to enter the value to encrypt and output the encrypted value.
  
  For example, imam -> {iisenc}cnILiNhvTEKhQwtEwhZmUQ==

b. Edit the file:

In this file, first you need to locate the Connector XML element used by the metadata interchange agent. Following is the snippet,