Novell IMANAGER - INSTALLATION V2.7, Installation Manual

Page: 14 / 32

14 Novell iManager 2.7 Installation Guide
n
ov
do
cx (e
n)
16
Ap
ril 20
10
1.3.2 Windows
The following instructions show how to create a keypair in eDirectory and export the Public, Private
and Root Certificate Authority (CA) keys via a PKCS#12 file on the Windows platform. This
includes modifying Tomcat's
server.xml
configuration file in order to use the PKCS12 directive
and point the configuration to an actual P12 file rather than use the default JKS keystore.
The files, and their default locations, associated with this process are as follows:
Š
The temporary keypair:
C:\Program Files\Novell\Tomcat\conf\ssl\. keystore
.
Š
The trusted root certificates:
C:\Program Files\Novell\jre\lib\security\cacerts
.
Š
Configure Tomcat's certificate use:
C:\Program Files\Novell\Tomcat\conf\server.xml
1. Create a new server certificate with iManager.
In iManager, select Novell Certificate Server > Create Server Certificate. Select the appropriate
server, specify a nickname and accept the rest of the certificate defaults.
2. Export the server certificate.
In iManager, select Directory Administration > Modify Object. Browse to and select the KMO
object. In the Certificates tab, select Export. Specify a password and save the server certificate
as a pkcs12 file (
.pfx
).
3. Convert the
.pfx
file to a
.pem
file.
NOTE: Openssl is not installed on Windows by default, but a version for the Windows
platform is available on the Openssl Web site (http://www.openssl.org/related/binaries.html) .
Alternatively, you can convert the certificate on a Linux platform, on which Openssl is installed
by default.
To do this, use a command similar to the following:
openssl pkcs12 -in newtomcert.pfx -out newtomcert.pem
Specify the certificate password from step 2, and specify a password for the new
.pem
file. You
can use the same password, if desired.
4. Convert the
.pem
file to a
.p12
file.
To do this, use a command similar to the following:
openssl pkcs12 -export -in newtomcert.pem -out newtomcert.p12 -name "New
Tomcat"
Specify the certificate password from step 3, and specify a password for the new
.p12
file. You
can use the same password, if desired.
5. Copy the .p12 file to the Tomcat certifcate location.
By default, this is
C:\Program Files\Novell\Tomcat\conf\ssl\
.
6. Stop the Tomcat Service.
/etc/init.d/novell-tomcat5 stop
7. Edit the Tomcat’s
server.xml
and add
keystoreType
,
keystoreFile
, and
keystorePass
variables to let Tomcat use the newly created
.p12
certificate file. For example: