Linux: Creating the trust relationship between SAM and M&R

You must export and import certificates to get the SAM Tomcat server and M&R Tomcat server to trust each other.

Prerequisites

First, export a certificate on the SAM server. Then import it into the M&R Tomcat server. Then export a certificate from the M&R server and import it into the SAM Tomcat server.

Procedure

1. Export a certificate from the SAM Tomcat server. For example,

   /opt/InCharge/SAM/smarts/jre/bin/keytool -storetype JKS -export -keystore /opt/InCharge/SAM/smarts/.keystore -alias tomcat -rfc > SAMtomcat.cert

   1. Copy SAMtomcat.cert to the host where M&R Tomcat server is installed.
   2. On the M&R host, import the SAMtomcat.cert. For example,

      /opt/APG/Java/Sun-JRE/<Java-Version>/bin/keytool -import -file SAMtomcat.cert -alias SAMtomcat -keystore /opt/APG/.keystore

      Note:
      If you see the following warning, type yes and continue :

      Certificate already exists in keystore under alias <tomcat>
      Do you still want to add it? [no]: yes
      Certificate was added to keystore

   3. Back up the original M&R cacerts file.

      cp /opt/APG/Java/Sun-JRE/<Java-Version>/lib/security/cacerts /opt/APG/Java/Sun-JRE/8.0u51/lib/security/cacerts-SAVE    # Backup old cacerts file

   4. Copy .keystore and rename it to cacerts.

      cp /opt/APG/.keystore /opt/APG/Java/Sun-JRE/<Java-Version>/lib/security/cacerts

2. Restart Tomcat server on the M&R host.

   /opt/APG/bin/manage-modules.sh service restart tomcat

3. Export a certificate from the M&R host. For example,

   /opt/APG/Java/Sun-JRE/<Java-Version>/bin/keytool -export -keystore /opt/APG/.keystore -alias tomcat -rfc > W4Ntomcat.cert

4. Copy W4ntomcat.cert to the SAM server host.
5. On the SAM server host, run this command to import a certificate copied from the M&R server host.

   /opt/InCharge/SAM/smarts/jre/bin/keytool -storetype JKS -import -file W4Ntomcat.cert -alias W4Ntomcat -keystore /opt/InCharge/SAM/smarts/.keystore

   Note:
   If you see the following warning, type yes and continue :

   Certificate already exists in keystore under alias <tomcat>
   Do you still want to add it? [no]: yes
   Certificate was added to keystore

6. Copy the keystore file.

   cp /opt/InCharge/SAM/smarts/jre/lib/security/cacerts /opt/InCharge/SAM/smarts/jre/lib/security/cacerts-SAVE    # Backup old cacerts file

   cp /opt/InCharge/SAM/smarts/.keystore /opt/InCharge/SAM/smarts/jre/lib/security/cacerts

7. Confirm the certificates copied properly (review entries).
   For SAM

   /opt/InCharge/SAM/smarts/jre/bin/keytool -storetype JKS -list -keystore /opt/InCharge/SAM/smarts/.keystore

   For M&R

   /opt/APG/Java/Sun-JRE/<Java-Version>/bin/keytool -list -keystore /opt/APG/.keystore

8. Stop and start the Tomcat service on the SAM server:
   1. /opt/InCharge/SAM/smarts/bin/sm_service stop smarts-tomcat
   2. /opt/InCharge/SAM/smarts/bin/sm_service start smarts-tomcat
9. Restart the M&R services.

   /opt/APG/bin/manage-modules.sh service restart all

10. Check the <SAM_BASEDIR>/smarts/local/logs/tomcat/smarts-edaa.log file for certificate exchange errors (SSLHandshake exception).

    If you see any such certificate exchange errors, it is recommended to remove <SAM_BASEDIR>/smarts /.keystore and /opt/APG/.keystore files and regenerate the certificates and perform certificate exchange again.