Creating a Java

...

KeyStore and SSL certificate

MettleCI Workbench can be configured to expose ports over HTTP, HTTPS, or both simultaneously at separate ports. Before configuring Workbench to use HTTPS, a Java

...

KeyStore containing the HTTPS certificate must be created first. Java

...

KeyStores can be created and managed using the keytool command included with all installations of Java

...

.

...

First ensure that you use the keytool command shipped with the Java v1.8 package you downloaded to support MettleCI. You can check which version of keytool is your command

...

line's default

...

by using the operating system-specific commands

...

where keytool

...

where  keytool

...

which keytool

. Verify that the response indicates that you will be using the keytool in the correct bin directory (e.g. in your OpenJDK installation).

Next, you’ll use

...

the keytool command

...

(with a format like that show below) to create a

...

KeyStore that contains a single, basic, self-signed certificate:

keytool -genkey -keyalg RSA -alias workbench -keystore <path-to-keystore> 
        -storepass <store-password> -storetype PKCS12 -keysize 2048 
        -sigalg SHA256withRSA -dname "CN=<host url>"

...

        -ext san=dns:<host url>
        -validity <days-valid>

Use the following table to replace the <placeholder-values> in this example command with values that are specific to your environment and policies.

...

For example, this command creates a keystore called workbench.p12 in the MettleCI home directory for use with workbench currently accessed at URL http://my-engine.datamigrators.com:8080:

...

This example generates a key with a 10-year validity.

$> keytool -genkey -keyalg RSA -alias workbench -keystore 

...

workbench.p12 \
-storepass changeit -storetype PKCS12 -keysize 2048 \
-sigalg SHA256withRSA -dname "CN=my-engine.datamigrators.com" \
-ext san=dns:my-engine.datamigrators.com \
-validity 3650

You can verify your keystore by listing the certificates within it. You’ll need to re-enter your keystore password, which is 'changeit' (no quotes) in our example.

keytool -list -v -keystore workbench.p12 -storetype PKCS12
Enter keystore password: ********

If you need to export your certificate for signing you can use a command like the following:

keytool -certreq -keyalg RSA -alias workbench -keystore 

...

workbench.p12
-storepass changeit -sigalg SHA256withRSA -file 

...

C:\dm\mci\workbench.csr 

...

...

...

Note that with the exception of keytool -list the keytool command will not normally return a value to the console to indicate it has executed successfully

Regenerating keys

If you want to regenerate your keystore certificate for any reason (i.e. it has expired) you can use the following command:

# Delete it
$> keytool -delete -noprompt -alias workbench  -keystore workbench.p12  -storepass changeit

...

...

# 

...

Verify 

...

it 

...

has 

...

been 

...

Ensure that your keystore has at least 644 (rw-r--r--) privileges. If you need to export your certificate for signing you can use a command like the following:

keytool -certreq -keyalg RSA -alias workbench -keystore C:\dm\mci\workbench.p12 -storepass changeit -sigalg SHA256withRSA -file C:\dm\mci\workbench.csr 

Note that the keytool will not normally return a value to the console.

...

deleted 
$>  keytool -list -v -keystore  /opt/dm/mci/workbench.p12  -storetype PKCS12  -storepass changeit
Keystore type: PKCS12
Keystore provider: SunJSSE

Your keystore contains 0 entries
$>

...

Enabling HTTPS support in the MettleCI Workbench config.yml

Once a keystore containing the Workbench HTTPS certificate has been created, update your MettleCI config.yml file to add the following section:

server:
  applicationConnectors:
    - type: https
      port: 8443
      keyStoreType: PKCS12
      keyStorePath: <path-to-keystore>
      keyStorePassword: <store-password>
      trustStoreType: PKCS12
      trustStorePath: <path-to-keystore>
      trustStorePassword: <store password>

The

...

<placeholder-values> must match those used while creating the Java

...

keystore. For example:

server:
  applicationConnectors:
    - type: https
      port: 8443
      keyStoreType: PKCS12
      keyStorePath: 

...

C:\dm\mci\workbench.p12
      keyStorePassword: changeit
      trustStoreType: PKCS12
      trustStorePath: 

...

C:\dm\mci\workbench.p12
      trustStorePassword: changeit

...

server:
  applicationConnectors:
    - type: http
      port: 8080
    - type: https
      port: 8443
      keyStoreType: PKCS12
      keyStorePath: C:\dm\mci\workbench.p12
      keyStorePassword: changeit
      trustStoreType: PKCS12
      trustStorePath: C:\dm\mci\workbench.p12
      trustStorePassword: changeit

...

...

sudo service dm-mettleci-workbench restart

Verify Workbench is up and running under HTTPS by navigating to https://<host url>:8443 in your browser

Enabling concurrent HTTP and HTTPS support

...

server:
  applicationConnectors:
    - type: https
      port: 8443
      keyStoreType: PKCS12
      keyStorePath: /opt/dm/mci/workbench.p12
      keyStorePassword: changeit
      trustStoreType: PKCS12
      trustStorePath: /opt/dm/mci/workbench.p12
      trustStorePassword: changeit

...

server:
  applicationConnectors:
    - type: http
      port: 8080
    - type: https
      port: 8443
      keyStoreType: PKCS12
      keyStorePath: 

...

/opt/dm/mci/workbench.p12
      keyStorePassword: 

...

changeit
      trustStoreType: PKCS12
      trustStorePath: 

...

/opt/dm/mci/workbench.p12
      trustStorePassword: 

...

changeit

The ports given above are only examples, and you’re free to use custom port numbers as desired.

Once your changes are saved restart your Workbench service using the

...

Services utility

sudo service dm-mettleci-workbench 

...

stop
sudo service dm-mettleci-workbench start

Verify Workbench is up and running under HTTP

...

and/or HTTPS by navigating to https://<host url>:8443 and/or http://<host url>:8080 (as appropriate) in your browser.

Trusting your certificate

You will need your local browser to trust the certificate on your DataStage engine tier. There will be slightly different processes for this depending upon your chosen browser and whether or not you have self-signed the certificate or used a CA.

Inspecting your certificate

Typically, when you first connect to Workbench using HTTPS you will see a certificate error in your browser. This may look like this…

...

or this…

...

Click on the warning indicator ('Not secure' or ‘Certificate error’ in these examples) and select Certificate (not valid).

...

This will present a certificate dialog which may or may not allow you to install the certificate.

Before you install your certificate click on the Details tab and look at the Thumbprint algorithm and Thumbprint values.

...

The Thumbprint value should match the appropriate value displayed by the keytool -list command you entered when you first generated your certificate keystore.

Certificate fingerprints:
  MD5:  86:6A:96:1E:29:19:45:F9:46:B9:E6:54:DD:D0:1D:6C
  SHA1: 11:A1:75:E2:71:AA:5D:C8:85:8A:BF:65:02:FC:09:2D:C7:41:CA:BC
  SHA256: 5C:3A:87:77:13:17:77:F8:7C:2F:8A:F4:48:0D:B6:61:31:92:91:B6:90:36:0B:4C:5B:BC:30:5F:EC:C1:CA:36

Once you’re happy that the thumbprint matches you can proceed to installing your certificate.

Installing your certificate

If Install Certificate is enabled then click it to install the certificate into the Trust Root Certification Authorities store

...

If Install Certificate is not enabled then select the Details tab in the Certificate dialog then click Copy to File.

...

1. Start the Certificate Export Wizard by clicking Next, accept the default settings, enter a meaningful certificate name to export it to your local system, and click Finish. Now the certificate has been successfully exported to a file.

2. In the Certificate Export Wizard success message, click Finish.

3. In the Certificate dialog, click OK.

You can now follow your operating system’s process for importing the certificate file into the Trust Root Certification Authorities store.