In some cases, a user's Certificate Authority (CA) already has a provided signed certificate. Some user's procedures require that they generate\retrieve a certificate in this way. It typically happens when the CA is issuing a wildcard certificate or when a sever goes by multiple domain names.
In these cases, it may be possible to simply import the signed certificate into apollo.keystore, if and only if, the signed certificate they have received contains the full certificate chain and private key.
Certificate formats which can contain the private key are listed below:
- PKCS#12 (.pfx or .p12) can store the server certificate, the intermediate certificate, and the private key in a single .pfx file with password protection. Since these files contain the full chain and the private key, it is possible to import it directly into apollo.keystore, but remember the alias and alias password is needed to do so (the owner of the certificate should have this information).
- PEM (.pem, .crt, .cer, or .key) can include the server certificate, the intermediate certificate, and the private key in a single file. The server certificate and intermediate certificate can also be in a separate .crt or .cer files and the private key can be in a .key file. If the server\intermediate certificates and key are separate, this will not suffice to import directly.
Check by opening the certificate file in a text editor.
Each certificate is contained between the ---- BEGIN CERTIFICATE---- and ----END CERTIFICATE---- statements.
The private key is contained between the ---- BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY----- statements.
Ensure that the number of certificates contained in ---- BEGIN CERTIFICATE---- and ----END CERTIFICATE---- statements matches the number of certificates in the chain (server and intermediate) and ends with ---- BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY.
If the file does not contain the full certificate chain and private key, the certificate must be imported into the keystore it was generated from. If you are unsure about the certificate chain, refer to KB article 532108:
How to manually separate the server, intermediate, and root certificates from a single signed certificate
Once the full certificate chain and private key are in one file is verified, everything that is needed to import the certificate into DPA via the following steps is provided:
- Make a copy of the apollo.keystore and standalone.xml files from dpa\services\standalone\configuration and the application-service.conf file from dpa\services\executive. In the event that you need to revert back to the original configuration, you can use these files to restore DPA to working order. Place the copies in a folder on the desktop for safe keeping and to avoid confusion.
- Open the copy of the standalone.xml file and search for 'key-alias'. A line containing the key-alias and password similar to this should be seen:
<ssl name="ssl" key-alias="${apollo.keystore.alias:apollokey}" password="apollo"
Take note of the password in this line. It is the apollo.keystore password and it is needed in the next steps.
- Run the following command from the DPA install directory in services\_jre\bin:
keytool -importkeystore -srckeystore "c:\Program files\emc\dpa\services\standalone\configuration\wildcard.pfx" -srcstoretype pkcs12 -destkeystore "c:\Program files\emc\dpa\services\standalone\configuration\apollo.keystore" -deststoretype JKS
Note: Specify the correct location of the signed certificate file (srckeystore) and apollo.keystore (destkeystore). See the example below for more information on what needs to be entered:
D:\Program Files\EMC\DPA\services\_jre\bin keytool -importkeystore -srckeystore "c:\Program files\emc\dpa\services\standalone\configuration\wildcard.pfx" -srcstoretype pkcs12 -destkeystore "c:\Program files\emc\dpa\services\standalone\configuration\apollo.keystore" -deststoretype JKS
Enter destination keystore password: (apollo.keystore password- check standalone.xml)
Enter source keystore password: (alias password-owner of certificate will know this)
Entry for alias my_alias successfully imported.
Import command completed:1 entries successfully imported, 0 entries failed or cancelled
- List the contents of apollo.keystore to verify that the signed certificate was imported correctly:
keytool -list -v -keystore "c:\Program files\emc\dpa\services\standalone\configuration\apollo.keystore"
(Enter the apollo.keystore password)
It should now contain the entry for apollokey and the new entry with the user's wildcardalias (whatever alias the signed certificate was assigned to). You should see that this is a PrivateKeyEntry and that is contains the full certificate chain.
- Restart application services and attempt to log into the GUI. In the event that restarting services produces an error, app svc fail to start, or you cannot access the GUI at this point:
- Open application-service.conf and search for 'apollo.key'. You should see that the alias has been updated to the alias you imported (in this case, wildcardalias).
- Open standalone.xml with a text editor and search for 'key-alias'. You should see a line similar to the one below that shows the alias you imported:
key-alias="${apollo.keystore.alias:emcdpa}"
If not, change the key alias to match the one associated with the signed certificate. Also, double check that the password is the same as you have been using throughout.
If you need to change the alias or password in these files, then:
- Stop application services.
- Edit and save the files.
- Restart services.
- If the issue persists, contact DPA support.