| Resolution | - Export public Ecat certificate
- From server\cert directory in Ecat get Ecat CA certificate
- Import ECAT public certificate to SA UI Java Store
- cd /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.65.x86_64/jre/bin
- ./keytool -import -v -trustcacerts -alias ECAT -file /root/B64EcatCA.cer -keystore /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.65.x86_64/jre/lib/security/cacerts -keypass changeit -storepass changeit
where
-alias ECAT = a name to give the cert in the keystore (can be anything)
-file /root/B64EcatCA.cer = exported CER from ECAT Server.
Results should be like this:
Owner: CN=EcatCA
Issuer: CN=EcatCA
Serial number: -271f479f6107d579bdb7a8766ca92be2
Valid from: Fri Sep 19 08:02:14 UTC 2014 until: Sat Dec 31 23:59:59 UTC 2039
Certificate fingerprints:
MD5: F2:6D:82:EB:D1:74:D7:E7:BE:C5:FB:9A:B5:36:44:E9
SHA1: 1C:CF:89:77:F9:61:68:B5:F8:64:DF:36:BD:D9:F6:16:71:FA:3B:34
SHA256: 3B:55:B6:F1:2E:EE:F3:1D:7A:0C:02:AA:87:80:22:E0:A1:D5:E6:7B:91:22:81:A6:FC:04:0F:29:21:5E:89:21
Signature algorithm name: SHA1withRSA
Version: 3
Extensions:
#1: ObjectId: 2.5.29.1 Criticality=false
0000: 30 39 80 10 EC 0C AF 37 EA 39 B4 70 FA 3E 30 3C 09.....7.9.p.>0<
0010: AF 4A EF F4 A1 13 30 11 31 0F 30 0D 06 03 55 04 .J....0.1.0...U.
0020: 03 13 06 45 63 61 74 43 41 82 10 D8 E0 B8 60 9E ...EcatCA.....`.
0030: F8 2A 86 42 48 57 89 93 56 D4 1E .*.BHW..V..
Trust this certificate? [no]: yes
Certificate was added to keystore
[Storing /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.65.x86_64/jre/lib/security/cacerts]
[root@RSASA bin]#
- To check the keystore run this command and search by alias name you configured
./keytool -list -keystore /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.65.x86_64/jre/lib/security/cacerts | grep -i ECAT
Enter keystore password: changeit
ecat, 21/09/2014, trustedCertEntry,
- Restart jetty
- a-stop jettysrv
- b-start jettysr
- From SA UI Go to Live--->Feeds-->Add new Feed in URL insert the following URL
https://EcatServerExported:9443/ext/feed/machines.csv
Make sure that SA can resolve EcatServerExported to Ecat IP address either by DNS or putting this entry in the hosts' file.
Also Double confirm that SA can reach Ecat on the following port 9443 using openssl
openssl s_client -connect EcatServerExported:9443 and check if you can see Connected or not
this mean port is accessible
- If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.
|
on Jun 14, 2016