Configuring for SSL communication between the Operations Center and the hub server

To use the Secure Sockets Layer (SSL) protocol to secure communications between the Operations Center and the hub server, you must add the SSL certificate of the hub server to the truststore file of the Operations Center.

1. To ensure that SSL ports are set on the hub server, complete the following steps:
   1. From a Tivoli® Storage Manager command line, issue the following command to the hub server:

      QUERY OPTION SSL*

      The results include four server options, as shown in the following example:

      Server Option	Option Setting
      ------------------------------
      SSLTCPPort	3700
      SSLTCPADMINPort	3800
      SSLTLS12	Yes
      SSLFIPSMODE	No

   2. Ensure that the SSLTCPPORT option has a value in the Option Setting column. Also, ensure that the SSLTLS12 option is set to YES so that the Transport Layer Security (TLS) protocol version 1.2 is used for communication. To update the values of these options, edit the dsmserv.opt file of the hub server, and restart the hub server.
2. Specify the cert256.arm certificate as the default certificate in the key database file of the hub server.

   The cert256.arm certificate must be used for SSL connections to the hub server if the SSLTLS12 option is set to YES. To specify cert256.arm as the default certificate, complete the following steps:

   1. Issue the following command from the hub server instance directory:

      gsk8capicmd_64 -cert -setdefault -db cert.kdb -stashed
       -label "TSM Server SelfSigned SHA Key"	

   2. Restart the hub server so that it can receive the changes to the key database file.
3. To verify that the cert256.arm certificate is set as the default certificate in the key database file of the hub server, issue the following command:

   gsk8capicmd_64 -cert -list -db cert.kdb -stashed 

4. Stop the Operations Center web server.
5. Go to the command line of the operating system on which the Operations Center is installed.
6. Go to the following directory, where installation_dir represents the directory in which the Operations Center is installed:
   • installation_dir/ui/jre/bin
   • installation_dir\ui\jre\bin
7. Open the IBM Key Management window by issuing the following command:

    ikeyman

8. Click Key Database File > Open.
9. In the Open window, click Browse, and go to the following directory, where installation_dir represents the directory in which the Operations Center is installed:
   • installation_dir/ui/Liberty/usr/servers/guiServer
   • installation_dir\ui\Liberty\usr\servers\guiServer
10. In the guiServer directory, select the gui-truststore.jks file.
11. Click Open, and click OK.
12. Enter the password for the truststore file, and click OK.
13. In the Key database content area of the IBM Key Management window, click the arrow, and select Signer Certificates from the list.
14. Click Add.
15. In the Open window, click Browse, and go to the hub server instance directory, as shown in the following example:
    • /opt/tivoli/tsm/server/bin
    • c:\Program Files\Tivoli\TSM\server1
    The directory contains the following SSL certificates:

    • cert.arm
    • cert256.arm
    If you cannot access the hub server instance directory from the Open window, complete the following steps:

    1. Use FTP or another file-transfer method to copy the cert256.arm files from the hub server to the following directory on the computer where the Operations Center is installed:
       • installation_dir/ui/Liberty/usr/servers/guiServer
       • installation_dir\ui\Liberty\usr\servers\guiServer
    2. In the Open window, go to the guiServer directory.
16. Because the SSLTLS12 server option is set to YES, select the cert256.arm certificate as the SSL certificate.
    Tip: The certificate that you choose must be set as the default certificate in the key database file of the hub server. For more information, see step 2 and 3.
17. Click Open, and click OK.
18. Enter a label for the certificate. For example, enter the name of the hub server.
19. Click OK. The SSL certificate of the hub server is added to the truststore file, and the label is displayed in the Key database content area of the IBM Key Management window.
20. Close the IBM Key Management window.
21. Start the Operations Center web server.
22. To configure the Operations Center, complete the following steps in the login window of the configuration wizard:
    1. In the Connect to field, enter the value of one of the following server options as the port number:
       • SSLTCPPORT
       • SSLTCPADMINPORT
       Tip: If the SSLTCPADMINPORT option has a value, use that value. Otherwise, use the value of the SSLTCPPORT option.
    2. Select the Use SSL option.
    If the Operations Center was previously configured, you can review the contents of the serverConnection.properties file to verify the connection information. The serverConnection.properties file is in the following directory on the computer where the Operations Center is installed:

    • installation_dir/ui/Liberty/usr/servers/guiServer
    • installation_dir\ui\Liberty\usr\servers\guiServer