A.5 Building an environment for using HTTPS with the external system linkage configuration

(1) Building an environment

You have to take the following steps to use HTTPS connection with the external system linkage configuration.

Obtaining certificates for SSL communication for the management server

From a Certificate Authority, obtain certificates (root certificate and SSL server certificate) for SSL communication for the management server.

The flow of obtaining certificates for SSL communication for the management server is as follows:

1. Create a private key for the Web server (openssl.bat genrsa command).

2. Create a Certificate Signing Request (CSR) (openssl.bat req command).

3. Display the contents of a Certificate Signing Request (CSR) (openssl.bat req command).

   If necessary, check the contents of the Certificate Signing Request (CSR).

4. Send the CSR to the CA.

5. Acquire a certificate from the CA.

   Tip

   You can use the openssl.bat x509 command to check the contents of the certificate you obtained.

   Tip

   In the certificate you obtained, save the part from -----BEGINCERTIFICATE----- to -----END CERTIFICATE---- in another file (httpsd.pem file defined in httpsd.conf provided as standard).

Related Topics:

• (a) Creating a private key for the Web server (openssl.bat genrsa command)

• (b) Creating a Certificate Signing Request (CSR) (openssl.bat req command)

• (c) Displaying the contents of a Certificate Signing Request (CSR) (openssl.bat req command)

• (d) Displaying certificate contents (openssl.bat x509 command)

• (e) Converting the certificate format (openssl.bat x509 command)

Setting up the management server

1. Log on to the OS as a member of the Administrators group.

2. Stop the JP1/IT Desktop Management 2 services on the management server

   Execute the following command:

   stopservice

   For details about the commands, see the JP1/IT Desktop Management 2 Administration Guide.

3. Store an SSL server certificate and a private key in the following folder on the management server:

   JP1/IT Desktop Management 2 - Manager-installation-folder\mgr\uCPSB\httpsd\conf\ssl\server

   You have to store the following files in the above folder:

   • The SSL server certificate file: httpsd.pem

   • The private key file: httpsdkey.pem

   Note

   When you change the connection setting from HTTPS to HTTP, delete SSL server certificate and private key.

4. Edit the configuration file to include a statement.

   The configuration file (jdn_manager_config.conf) exists in the following location:

   JP1/IT Desktop Management 2 - Manager-installation-folder\mgr\conf

   Edit the configuration file to include the following statement: RestAPIProtocol=1

   Note

   When you change the connection setting from HTTPS to HTTP, change the statement of the configuration file RestAPIProtocol=1 to RestAPIProtocol=0. Do not delete the row of RestAPIProtocol that you added.

5. From the Windows Start menu, select All Programs, JP1_IT Desktop Management 2 - Manager, Tools, and then Setup.

6. In the Setup window, click the Next button.

7. In the Select a Setup view, select Settings Modification, and then click the Next button.

8. Click the Next button until the API settings view appears.

9. Select the Use the API check box.

10. Click the Next button.

11. Click the Next button until the Confirm Setup Settings view appears.

12. In the Confirm Setup Settings view, confirm that the specified settings are correct, and then click the Next button.

    A dialog to confirm that Remote Install Manager and JP1/IT Desktop Management 2 - Asset Console have been stopped is displayed. After confirming, click the OK button. In the cluster system, make the cluster resources associated with the services displayed in the dialog offline, and then click the OK button.

13. In the Setup for Distribution by Using Remote Install Manager view, click the OK button.

    The setup process begins, and a dialog box appears indicating that setup is in progress. When setup has finished, the Setup Complete view appears.

    Important

    When the dialog box that says "Could not start the service. Service name=JP1_ITDM2_Web Server." appears, complete the setup by clicking the OK button to close the dialog box. Then, review the SSL server certificate file and the private key file in step 3, and then directly start the service of JP1_ITDM2_Web Server. When the dialog box of "An error occurred during Setup." appears, review the RestAPIProtocol value which is set in step 4 is correct.

14. In the Setup Complete view, click the OK button.

Note

In case of a cluster system, setup the primary server and the standby server.

To Page Top

(2) Commands used to acquire certificates for SSL communication

The following describes the commands used to acquire certificates for SSL communication.

The commands are stored in the following folders:

JP1/IT Desktop Management 2 - Manager-installation-folder\mgr\uCPSB\httpsd\bin

openssl.bat∆genrsa∆-rand∆file-name[:file-name...]∆-out∆key-file∆[512|1024|2048|4096]

openssl.bat genrsa -rand C:\WINNT\NOTEPAD.EXE -out httpsdkey.pem 2048

openssl.bat∆req∆-new∆-sha256∆-key∆key-file∆-out∆CSR-file

openssl.bat req -new -sha256 -key httpsdkey.pem -out httpsd.csr

openssl.bat∆req∆-in∆CSR-file∆-text

openssl.bat req -in httpsd.csr -text

openssl.bat∆x509∆-in∆certificate-file∆-text

openssl.bat x509 -in httpsd.pem -text

openssl.bat∆x509∆-inform∆input-format∆-outform∆output-format∆-in∆input-file∆-out∆output-file

To Page Top