Configuring SSL

Depending on your database, you can configure lc_mysql.xml, lc_mssql.xml, lc_oracle.xml, or lc_turnkey.xml file as the profile file for your database. In the following steps, wherever [profile_name] is mentioned, replace it with appropriate profile name:

1. Navigate to [Adobe_JAVA_HOME]/ bin and type the following command to create the keystore:

   keytool -genkey -dname "CN= Host Name , OU= Group Name , O= Company Name , L= City Name , S= State , C= Country Code " - alias "LC Cert" - keyalg rsa -keypass key_password -keystore keystorename. keystore

   Replace [Adobe_JAVA_HOME] with the name of the directory where the JDK is installed, and replace the text in bold with values that correspond to your environment. The Host Name is the fully qualified domain name of the application server.

2. Enter the keystore_password when prompted for a password. The password for the keystore and the key must be identical.

   Note: The keystore_password entered at this step may be the same password (key_password) that you entered in step 1, or may be different.

3. Copy the keystorename. keystore file to the [JBoss root] \standalone\configuration directory by typing the following command:

       copy keystorename.keystore [JBoss root]/standalone/configuration

4. Export the certificate file by typing the following command:

   keytool -export -alias "LC Cert" -file LC_cert.cer -keystore [JBoss root]\standalone\configuration\keystorename.keystore

5. Enter the keystore_password when prompted for a password.

6. Copy the LC_cert.cer file to the [JBoss root] configuration directory by typing the following command:

   copy LC_cert.cer [JBoss root]\standalone\configuration

7. View the contents of the certificate by typing the following command:

   keytool -printcert -v -file [JBoss root]\standalone\configuration\LC_cert.cer

8. If necessary, provide write access to the cacerts file in [Adobe_JAVA_HOME]\jre\lib\security. Right-click the cacerts file, select Properties, and then deselect the Read-only attribute.

9. Import the certificate by typing the following command:

   keytool -import -alias "LC Cert" -file LC_cert.cer -keystore [Adobe_JAVA_HOME]\jre\lib\security\cacerts

10. Type changeit as the password. changeit is the default password for a Java installation.

11. When prompted if you Trust this certificate? [no]:, type yes . The confirmation "Certificate was added to keystore” is displayed.

12. In a text editor, open the file

    [JBoss root]\standalone\configuration\[profile_name].

13. Uncomment the following lines in the [profile_name] file:

    <!-- SSL/TLS Connector configuration using the admin devl guide keystore <Connector port="8443" address="${jboss.bind.address}" maxThreads="100" strategy="ms" maxHttpHeaderSize="8192" emptySessionPath="true" scheme="https" secure="true" clientAuth="false" keystoreFile="${jboss.server.home.dir}/conf/keystoreFile.keystore" keystorePass="keystorePass" sslProtocol = "TLS" />

    -->

14. For the keystoreFile attribute in [profile_name] specify the path of the keystore file you created. Specify keystore_password for the keystorePass attribute in [profile_name] .

15. Save the [profile_name] file.

16. Restart the application server:

    • For turnkey installations:

      • From the Windows Control Panel , click Administrative Tools , and then click Services .

      • Select JBoss for Adobe Experience Manager forms.

      • Select Action > Stop.

      • Wait for the status of the service to appear as stopped.

      • Select Action > Start.

    • For Adobe preconfigured or manually configured JBoss installations:

      • From a command prompt, navigate to [appserver root] /bin.

      • Stop the server by entering the following command:

        • (Windows) jboss-cli.bat --connect command=:shutdown

        • (Linux) ./jboss-cli.sh --connect command=:shutdown

      • Wait until the JBoss process has fully shut down (when the JBoss process returns control to the terminal it was started in).

      • Start the server by entering the following command:

        • (Windows) standalone.bat -c [profile_name] -b [server_IP_Address]

        • (Linux) ./standalone.sh -c [profile_name] -b [server_IP_Address]

17. To access administration console using SSL, type https://[host name]:[port]/adminui in a web browser:

    The default SSL port for JBoss is 8443. From here on, specify this port when accessing AEM forms.

1. In a command prompt, navigate to [JAVA HOME] /bin and type the following command to create the keystore and the key:

   keytool -genkey -dname "CN= Host Name , OU= Group Name , O= Company Name , L= City Name , S= State , C= Country Code " -alias " LC Cert " -keyalg RSA -keypass – key_password -keystore keystorename .keystore

   Note: Replace [JAVA_HOME] with the directory where the JDK is installed, and replace the text in italic with values that correspond with your environment.

2. Type the following command to generate a certificate request to send to the certificate authority:

   keytool -certreq -alias "LC Cert" -keystore keystorename .keystore -file LCcertRequest.csr

3. When your request for a certificate file is fulfilled, complete the next procedure.

1. In a command prompt, navigate to [JAVA HOME] /bin and type the following command to import the root certificate of the CA with which the CSR has been signed:

   keytool -import -trustcacerts -file rootcert .pem -keystore keystorename .keystore -alias root

   If the root certificate is not in the browser, also import it there.

   Note: Replace [JAVA_HOME] with the directory where the JDK is installed, and replace the text in italic with values that correspond with your environment.

2. In a command prompt, navigate to [JAVA HOME] /bin and type the following command to import the credential into the keystore:

   keytool -import -trustcacerts -file CACertificateName .crt -keystore keystorename .keystore

   Note: Replace [JAVA_HOME] with the directory where the JDK is installed, and replace the text in italic with values that correspond with your environment.
   Note: The imported CA signed certificate will replace a self-signed public certificate if it exists.

3. Complete steps 13 - 18 of Create an SSL credential.

The keytool command is typically located in the Java jre/bin directory and must include several options and option values, which are listed in the following table.

ads-ca.cer

For more information about using the keytool command, see the keytool.html file that is part of your JDK documentation.

1. From a command prompt, navigate to [appserverdomain] /adobe/ [server name] .

2. Enter the following command:

   [ JAVA_HOME ]/bin/keytool -genkey -v -alias ads-credentials -keyalg RSA -keystore "ads-credentials.jks" -validity 3650 -storepass store_password -keypass key_password -dname "CN= Hostname , OU= Group Name , O= Company Name , L= City Name , S= State ,C= Country Code

   Note: Replace [JAVA_HOME] with the directory where the JDK is installed, and replace the text in italic with values that correspond with your environment.

   For example:

   C:\Program Files\Java\jrockit-jdk1.6.0_24-R28\bin\keytool" -genkey -v -alias ads-credentials -keyalg RSA -keystore "ads-credentials.jks" -validity 3650 -storepass P@ssw0rd -keypass P@ssw0rd -dname "CN=wasnode01, OU=LC, O=Adobe, L=Noida, S=UP,C=91

   The Custom Identity keystore file named ‘‘ads-credentials.jks” is created in the [ appserverdomain ]/adobe/[ server name ] directory.

3. Extract the certificate from the ads-credentials keystore by entering the following command:

   [JAVA_HOME] /bin/keytool -export -v -alias ads-credentials

   -file "ads-ca.cer" -keystore "ads-credentials.jks"

   -storepass store _ password

   Note: Replace [JAVA_HOME] with the directory where the JDK is installed, and replace store _ password with the password for the Custom Identity keystore.

   For example:

   C:\Program Files\Java\jrockit-jdk1.6.0_24-R28\bin\keytool" -export -v -alias ads-credentials -file "ads-ca.cer" -keystore "ads-credentials.jks" -storepass P@ssw0rd

   The certificate file named “ads-ca.cer” is created in the [ appserverdomain ]/adobe/[ server name ] directory.

4. Copy the ads-ca.cer file to any host computers that need secure communication with the application server.

5. Insert the certificate into a new keystore file (the Custom Trust keystore) by entering the following command:

   [JAVA_HOME] /bin/keytool -import -v -noprompt -alias bedrock -file "ads-ca.cer" -keystore "ads-ca.jks" -storepass store_password -keypass key_password

   Note: Replace [JAVA_HOME] with the directory where the JDK is installed, and replace store _ password and key _ password with your own passwords.

   For example:

   C:\Program Files\Java\jrockit-jdk1.6.0_24-R28\bin\keytool" -import -v -noprompt -alias bedrock -file "ads-ca.cer" -keystore "ads-ca.jks" -storepass Password1 -keypass Password1

The Custom Trust keystore file named ‘‘ads-ca.jks’’ is created in the [ appserverdomain ]/adobe/[ server ] directory.

Configure WebLogic so that it uses the Custom Identity keystore and Custom Trust keystore that you created. Also, disable the WebLogic Hostname Verification feature because the distinguished name used to create the keystore files did not include the name of the computer that hosts WebLogic Server.

1. Start the WebLogic Server administration console by typing http:// [host name] :7001/console in the URL line of a web browser.

2. Under Environment, in Domain Configurations, select Servers > [ server ] > Configuration > General .

3. Under General, in Configuration, ensure that Listen Port Enabled and SSL Listen Port Enabled are selected. If not enabled, do the following:

   1. Under the Change Center, click Lock & Edit to modify selections and values.

   2. Check the Listen Port Enabled and SSL Listen Port Enabled check boxes.

4. If this server is a Managed Server, change Listen Port to an unused port value (such as 8001) and SSL Listen Port to an unused port value (such as 8002). On a stand-alone server, the default SSL port is 7002.

5. Click Release Configuration .

6. Under Environment, in Domain Configurations, click Servers > [ Managed Server ] > Configuration > General .

7. Under General, in Configuration, select Keystores .

8. Under the Change Center, click Lock & Edit to modify selections and values.

9. Click Change to to get the keystore list as drop-down list and select Custom Identity And Custom Trust .

10. Under Identity, specify the following values:

    Custom Identity Keystore : [appserverdomain] /adobe/ [server name] /ads-credentials.jks, where [appserverdomain] is the actual path and [server name] is the name of the application server.

    Custom Identity Keystore Type : JKS

    Custom Identity Keystore Passphrase : mypassword (custom identity keystore password)

11. Under Trust, specify the following values:

    Custom Trust Keystore File Name : [appserverdomain] /adobe/ [server] /ads-ca.jks, where [appserverdomain] is the actual path

    Custom Trust Keystore Type : JKS

    Custom Trust Keystore Pass Phrase : mypassword (custom trust key password)

12. Under General, in Configuration, select SSL .

13. By default, Keystore is selected for Identity and Trust Locations. If not, change it to keystore.

14. Under Identity, specify the following values:

    Private Key Alias : ads-credentials

    Passphrase : mypassword

15. Click Release Configuration .

1. On the Configuration tab, click SSL.

2. Under Advanced, select None from the Hostname Verification list.

   If Hostname Verification is not disabled, the Common Name (CN) must contain the server host name.

3. Under Change Center, click Lock & Edit to modify selections and values.

4. Restart the application server.

For enabling SSL, WebSphere needs access to a user account in the local OS user registry that has permission to administer the system:

• (Windows) Create a new Windows user who is part of the Administrators group and has the privilege to act as part of the operating system. (See Create a Windows user for WebSphere .)

• (Linux, UNIX) The user can be a root user or another user who has root privileges. When you enable SSL on WebSphere, use the server identification and password of this user.

1. In WebSphere Administrative Console, select Security > Global Security .

2. Click Security Configuration Wizard .

3. Ensure Enable Application Security checkbox is enabled. Click Next .

4. Select Federated Repositories and click Next .

5. Specify the credentials you want to set and click Next .

6. Click Finish .

7. Restart the WebSphere profile.

   WebSphere will start using the default keystore and truststore.

Truststores and keystores can be created using ikeyman utility or admin console. To make ikeyman work properly, enure that the WebSphere installation path does not contain parentheses.

1. In WebSphere Administrative Console, select Security > SSL certificate and key management .

2. Click Keystores and certificates under Related items.

3. In the Key store usages dropdown, ensure that SSL Keystores is selected. Click New .

4. Type a logical name and description.

5. Specify the path where you want your keystore to be created. If you have already created a keystore through ikeyman, specify the path to the keystore file.

6. Specify and confirm the password.

7. Choose the keystore type and click Apply .

8. Save the master configuration.

9. Click Personal Certificate .

10. If you had added already created a keystore using ikeyman, your certificate will appear. Otherwise, you need to add a new self-signed certificate by performing the following steps:

    1. Select Create > Self-signed Certificate .

    2. Specify appropriate values on the certificate form. Ensure that you keep Alias and common name as fully-qualified domain name of the machine.

    3. Click Apply .

11. Repeat steps 2 through 10 for creating a truststore.

1. In WebSphere Administrative Console, select Security > SSL certificate and key management .

2. Click Manage endpoint security configuration . The local topology map opens.

3. Under Inbound, select direct child of nodes.

4. Under Related items, select SSL configurations .

5. Select NodeDeafultSSLSetting .

6. From the truststore name and keystore name drop-down lists, select the custom truststore and keystore that you created.

7. Click Apply .

8. Save the master configuration.

9. Restart the WebSphere profile.

   Your profile now runs on custom SSL settings and your certificate.

1. In WebSphere Administrative Console, select Security > Global Security .

2. In the Authentication section, expand RMI/IIOP security and click CSIv2 inbound communications .

3. Ensure that SSL-supported is selected in the Transport drop down list.

4. Restart the WebSphere profile.

To convert a URL that begins with https, add a Signer certificate for that URL to the WebSphere server.

IBM WebSphere does not allow multiple calls to ORB.init() when Global Security is enabled. You can read about the permanent restriction at http://www-01.ibm.com/support/docview.wss?uid=swg1PK58704.

Perform the following steps to set the port to be dynamic and resolve the issue:

1. In WebSphere Administrative Console, select Servers > Server Types > WebSphere application server .

2. In the Preferences section, select your server.

3. In the Configuration tab, under Communications section, expand Ports , and click Details .

4. Click the following port names, change the port number to 0, and click OK .

   • ORB_LISTENER_ADDRESS

   • SAS_SSL_SERVERAUTH_LISTENER_ADDRESS

   • CSIV2_SSL_SERVERAUTH_LISTENER_ADDRESS

   • CSIV2_SSL_MUTUALAUTH_LISTENER_ADDRESS

1. Open [aem-forms_root]\crx-repository\launchpad\sling.properties file for editing.

2. Locate the sling.bootdelegation.ibm property and add com.ibm.websphere.ssl.* to its value field. The updated field look like the following:

   sling.bootdelegation.ibm=com.ibm.xml.*, com.ibm.websphere.ssl.*

3. Save the file and restart the server.