Replacing certificate for communication from IBM InfoSphere metadata asset manager to metadata interchange agents

Content

About this task
In general, the communication between WebSphere Application Server and Apache Tomcat occurs in two directions, and each direction can use a different certificate. These instructions describe how to change the certificate used for the communication from WebSphere Application Server to Apache Tomcat. If you want to change the certificate for the communication in the other direction, see the document.

If you want WebSphere Application Server and Apache Tomcat use the same certificate for communication in both directions, follow the instructions for updating the communication from Tomcat to WebSphere first. If you complete all the instructions, then come back to this document.

Step 1: Create a new InfoSphere metadata asset manager keystore

If the metadata interchange agent is running on IBM WebSphere Application Liberty profile, Go to step 3.

The digital certificate that is used by the metadata interchange agent running in Tomcat to decrypt the data coming in from InfoSphere metadata asset manager is stored in a file called imamkeystore.p12. If you want to update the certificate used in the communication, a new imamkeystore.p12 file needs to be created. These steps explain how to do that.

You can create a new imamkeystore.p12 and can set a new password for the keystore. If this password is set to something other than changeit, the server.xml in all of the Apache Tomcat instances need to be updated to use this new password.

These instructions assume that InfoSphere Information Server was installed to C:\IBM\InformationServer on the client tier. If you installed it in a different directory, you need to adjust the directory names for your environment.

There are three options for creating the imamkeystore.p12 file, depending on the type of new certificate you that want to use.

If you want to use a certificate signed by a certificate authority, you need to follow the steps in this section. Take following steps to generate your certificate request else there can be a problem to import the signed certificate into your keystore.

1. Open a Windows command shell on any client tier and run the following command:

SET PATH=C:\IBM\InformationServer\ASBNode\apps\jre\bin;%PATH%

2. Generate the keystore and the certificate to be signed and enter the information you want to be in the certificate when prompted.

keytool error: java.lang.Exception: Failed to establish chain from reply

1. Run the following commands in a Windows command shell on any client tier,

SET PATH=C:\IBM\InformationServer\ASBNode\apps\jre\bin;%PATH%

keytool -genkeypair -alias imamagent [-keyalg keyalg] [-keysize keysize] [-sigalg sigalg] -storetype pkcs12 -keystore imamkeystore.p12 [-validity validity]
For example, keytool -genkeypair -alias imamagent -keyalg RSA -keysize 2048 -storetype pkcs12 -keystore imamkeystore.p12 -validity 730

For keytool command, the values in the brackets are optional. Refer to the WebSphere Application Server documentation for a complete list of compatible values that can be specified for the keytool command.

Option 3: Use the certificate in the keystore in WebSphere Application Server

If you want WebSphere Application Server and Apache Tomcat to use the same certificate for communication in both the directions, then use this option. These steps assume that the IISKeyStore keystore in WebSphere Application Server is already updated with the certificate you want to be used for the communication in both directions. If WebSphere is not updated, then first follow the steps mentioned here and then proceed with the following steps.

1. Open the WebSphere administrative console.

2. Go to, Security -> SSL certificate and key management -> Key stores and certificates -> IISKeyStore -> Personal certificates

Keystore type: pkcs12

Keystore provider: IBMJCE
Your keystore contains 1 entry
imamagent, mmm dd, yyyy, keyEntry,
Certificate fingerprint (MD5): B6:A9:89:AE:21:08:B1:A3:7A:6D:8B:8E:BF:B8:BC:86

ca, mmm dd, yyyy, trustedCertEntry,
Certificate fingerprint (MD5): 10:67:7B:69:1E:D5:00:85:68:B9:9C:E8:6F:CE:9F:45

<Connector port="19443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="true" sslProtocol="TLS"
keyAlias="imamagent"
keystoreFile="C:\IBM\InformationServer\Clients\MetaBrokersAndBridges\web\conf\imamkeystore.p12"
keystorePass="{iisenc}cNvTqnua8+MHKKem3qkERw=="
keystoreType="pkcs12"
truststoreFile="C:\IBM\InformationServer\Clients\MetaBrokersAndBridges\web\conf\imamtruststore.p12"
truststorePass="{iisenc}cNvTqnua8+MHKKem3qkERw=="
truststoreType="pkcs12" 
encrypted="true"/>

<Connector port="19443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150"
scheme="https"
secure="true"
clientAuth="true"
sslProtocol="TLS" 
keyAlias="imamagent" keystoreFile="C:\IBM\InformationServer\Clients\MetaBrokersAndBridges\web\conf\imamkeystore.p12" 
keystorePass="iisenc}cnILiNhvTEKhQwtEwhZmUQ==" 
keystoreType="pkcs12" 
truststoreFile="C:\IBM\InformationServer\Clients\MetaBrokersAndBridges\web\conf\imamtruststore.p12" 
truststorePass="iisenc}cNvTqnua8+MHKKem3qkERw==" 
truststoreType="pkcs12" 
encrypted="true"/>