Exchanging and configuring certificates

Last Updated : Oct 18, 2023 |
Prolog information
Metadata
Keywords:
Use this procedure to exchange and configure certificates for Avaya Orchestration Designer on a single or multiple application servers.
Important:
For multiple application servers, repeat all steps for each application server.
Before you begin
Configure the POM database.
  1. Using the browser window, log in to the EPM as an administrator.
    ADDITIONAL INFORMATION:
    Note:
    For multiple POM servers, log in to the primary EPM.
  2. In the navigation pane, click SecurityCertificates.
  3. On the Root Certificates tab, click Export, and then save the certificate on the local system.
  4. In the navigation pane, click Proactive OutreachManager.
  5. Click ConfigurationsServers.
  6. Click Export on the listed certificate tab and save it on your local system.
    ADDITIONAL INFORMATION:
    Note:
    For multiple POM servers, you must export and save all the POM certificates.
  7. You can install the Avaya Orchestration Designer application server on the same server where you install POM. In such cases the IP address of the application server and the IP address of the EPM primary server is the same. The default port is 7443. If you are using an external application server and you have installed POM Avaya Orchestration Designer application package then while installing POM, you must:
    1. Copy the *.war files from $POM_HOME/DDapps to $APPSERVER_HOME/webapps of the external application server.
    2. If the file log4j-1.2.15.jar is present in $CATALINA_HOME/lib, then delete it from your external application server.
      ADDITIONAL INFORMATION:
      Note:
      The Primary server folder $POM_HOME/DDapps/lib* and the External Application Server folder $CATALINA_HOME/lib must contain the same files. If the External Application Server folder $CATALINA_HOME/lib contains any other files than the Primary server folder $POM_HOME/DDapps/lib, ensure you keep only JAR versions of files that are available in $POM_HOME/DDapps/lib.
    3. Copy files from $POM_HOME/DDapps/lib/* to $APPSERVER_HOME/lib of your external application server. After copying the files, edit $APPSERVER_HOME/conf/server.xml and add the following:
      ADDITIONAL INFORMATION: <Connector protocol="HTTP/1.1"
      port="7443" minSpareThreads="5" maxSpareThreads="75"
      enableLookups="true" disableUploadTimeout="true"
      acceptCount="100"  maxThreads="200"
      scheme="https" secure="true" SSLEnabled="true"
      keystoreFile="/opt/AppServer/Tomcat/tomcat/conf/myTrustStore" keystoreType="JKS" keystorePass="changeit"
      clientAuth="false" sslEnabledProtocols="TLSv1.2"
      ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_EMPTY_RENEGOTIATION_INFO_SCSV"/> 
      ADDITIONAL INFORMATION:
      Note:
    4. In the Command Line Interface (CLI), navigate to $APPSERVER_HOME/conf.
    5. Run the command keytool -keystore myTrustStore -genkey -alias dummy -keyalg RSA
    6. Type the password as changeit and type other appropriate details.
  8. Using the browser window, log in to the Avaya Orchestration Designer application server by specifying the URL https://<application server IP address>:port number/runtimeconfig using the default user name and the password as ddadmin.
    ADDITIONAL INFORMATION:
    The system prompts to set runtimeconfig password at the first login to the local application server.
  9. On the Avaya Orchestration Designer web interface, do the following:
    1. In the navigation pane, Click Certificates.
    2. On the Certificates page, select the default certificate and click Delete.
    3. Click Change.
      ADDITIONAL INFORMATION:
      The system displays Change Keystore page.
    4. In the Keystore Path field, type Absolute-path appserver-home>/conf/myTrustStore.
      ADDITIONAL INFORMATION:
      If you have installed the application server on the same server where you install POM, then the <Absolute-path-appserver-home> is set in the {$APPSERVER_HOME} environmental variable.
    5. In the Password field, type changeit.
      ADDITIONAL INFORMATION:
      Note:
      To use a different trust store and the password, change the Absolute-path-appserver-home>/conf/server.xml file accordingly, and ensure that the server.xml keystore path is valid and matches with Avaya Orchestration Designer application certificate as <Absolute-pathappserver-home>/conf/myTrustStore.
    6. In the Confirm field, type changeit.
    7. Click Save.
    8. On the Certificates page, click Generate.
    9. Enter the appropriate values in all fields. Input for all fields is mandatory. You can enter any custom defined values.
      ADDITIONAL INFORMATION:
      Note:
      For SAN field, enter the values in the IP:<IP address> or DNS: <hostname> format.
      The self-signed certificate is valid only for 1186 days.
      The Common Name (CN) field should have Hostname/FQDN.
      If Enable Server Identity Validation parameter is set to Yes under the security settings, in the Certificate tab of the Experience Portal, then you must have Hostname/FQDN set in SAN field.
      If you have configured orchestration designer applications with the URI containing the IP address under the Applications tab of the system configuration in the Experience Portal, then you must have the IP address set in the SAN field.
    10. Click Continue.
      ADDITIONAL INFORMATION:
      The system displays the Certificates page.
    11. Click Save.
    12. Click Add.
      ADDITIONAL INFORMATION:
      The system displays the Add Certificate page.
    13. Type a name for the EPM certificate and browse to find the path where you saved the primary EPM root certificate exported in step 3.
    14. Click Continue.
      ADDITIONAL INFORMATION:
      The system displays the Certificates page.
    15. Click Save.
    16. Select the application server self-signed certificate generated and export the certificate on your local system.
    17. Click Fetch to fetch the primary EPM certificate.
      ADDITIONAL INFORMATION:
      The system displays the Add Certificate page.
      Note:
      In a multiple POM server environment, you must fetch the primary EPM certificate from all auxiliary EPM servers.
      If EPM certificate signing is disabled using the Disable Signing button from SecurityCertificateEP signing certificate and custom CA signed certificates are used, you must import all the CA certificates into POM truststore using POM trusted certificates page under Configurations.
      If EPM signing is enabled, you must import the EP root certificate, that is, EP signing certificate, into POM trust store using POM trusted certificate page.
    18. In the Name field, type the name of the certificate. For example, axis_prim or axis_aux.
    19. In the Enter Certificate Path field, type the client URL as https://<EPM IP address>/axis2.
      ADDITIONAL INFORMATION:
      The Avaya Orchestration Designer application fetches the axis2 certificate and adds it to the list of certificates.
    20. Click Continue.
      ADDITIONAL INFORMATION:
      The system displays the Certificates page.
    21. Click Save.
    1. Click Add.
      ADDITIONAL INFORMATION:
      The system displays the Add Certificate page.
    2. In the Name field, type a name of the POM certificate.
    3. In the Enter Certificate path field, click Browse and browse the path where you saved the certificate exported in the step 6.
    4. Click Continue.
      ADDITIONAL INFORMATION:
      The system displays the Certificates page.
    5. Click Save.
    6. Restart the application server.
  10. Using the browser window, log in to the primary EPM as administrator.
  11. Click SecurityCertificates.
  12. Click the Trusted Certificates tab and do the following:
    1. Click Upload.
    2. On the Upload Trusted Certificate page, type the name and browse the path where you have saved the certificate exported in step 9p.
    3. Click Continue.
      ADDITIONAL INFORMATION:
      The system displays the Certificates page.
    4. Click Save.
    5. Click Import.
      ADDITIONAL INFORMATION:
      The system displays the Import Trusted Certificate page.
    6. On the Import Trusted Certificate page, type the name and type the axis2 certificate path as https://<EPM Server IP address>/axis2.
      ADDITIONAL INFORMATION:
      For a multiple POM server environment, you must fetch the primary EPM certificate from all auxiliary EPM servers.
    7. Click Continue.
      ADDITIONAL INFORMATION:
      The system displays the Certificates page.
    8. Click Save.
  13. Using the browser window, log in to the EPM as an administrator.
    ADDITIONAL INFORMATION:
    Note:
    For multiple POM servers, log in to the primary EPM.
  14. In the navigation pane, click Proactive OutreachManager.
  15. Click ConfigurationsTrusted Certificates.
  16. Import the certificate exported in step 9h.
  17. In the Name field, type the name of the certificate. For example, appserver.
  18. Click Continue.
  19. Click Save.
  20. Restart the application server, all MPPs, and all auxiliary servers.