How to replace default self-signed Policy Manager Linux certificate with trusted CA created certificate - WithSecure Community
<main>
<article class="userContent">
<h3 data-version="4" data-article="000004509" data-id="issue">Issue:</h3>
<p>How can I replace the default self-signed Policy Manager Linux certificate with trusted CA created certificate?</p>
<h3 data-id="resolution">Resolution:</h3>
<p>The Policy Manager for Linux keystore is located inside "/var/opt/f-secure/fspms/data/fspms.jks" (version 12.30 and higher) or "/opt/f-secure/fspms/config/fspms.jks" for previous Policy Manager versions.<br><br>You can<b> use</b> the following command to query details about certificates stored in fspms.jks:<br></p><ul><li>/opt/f-secure/fspms/jre/bin/keytool -list -v -keystore fspms.jks -storepass superPASSWORD</li><li>You should see the following output:</li></ul><div>Keystore type: JKS<br>Keystore provider: SUN<br><br>Your keystore contains 1 entry<br><br>Alias name: fspms<br>Creation date: 20.09.2010<br>Entry type: PrivateKeyEntry<br>Certificate chain length: 1<br>Certificate[1]:<br>Owner: CN=f-secure.com, OU=f-secure.com, O=f-secure.com, C=EN<br>Issuer: CN=f-secure.com, OU=f-secure.com, O=f-secure.com, C=EN<br>Serial number: 4c977fcc<br>Valid from: Mon Sep 20 18:37:48 EEST 2010 until: Wed Aug 27 18:37:48 EEST 2110<br>Certificate fingerprints:<br> MD5: 00:2D:4E:23:3A:9C:68:22:CD:CE:72:43:2B:CC:98:00<br> SHA1: 7C:F7:E1:2D:2E:6C:0A:86:66:53:E2:C7:59:2C:F2:9E:89:B6:4F:BD<br> SHA256: 02:87:BD:AF:BB:2B:F2:BB:13:A5:96:A8:F1:5D:DC:5C:67:AB:77:68:AF:36:85:1F:F2:F7:DE:29:88:AD:DF:D1<br> Signature algorithm name: SHA1withDSA<br> Version: 3</div><br><br>You can follow the steps below to replace the default self-signed Policy Manager Linux certificate:<br><br>Assume that you have:
<ul><li>The signed or maybe self-signed certificate (with full chain of intermediate CA) and private key for it inside PKCS12 keystore.</li><li>It is protected with password " srcpassword "</li><li>Your certificate and the private key are referenced by name (alias) " server ".</li><li>The keystore file is " server.p12 " and it is located in the same directory as " fspms.jks ".</li></ul><b>NOTE: </b>When you execute importkeystore command pay attention to "-destkeypass", it should be same as "-deststorepass". If you forget to insert proper "-destkeypass" command can complete successfully but problems on Policy Manager server startup may occur.
<ol><li><b>Type</b> the following command:</li></ol><ul><li>/opt/f-secure/fspms/jre/bin/keytool -importkeystore -destkeystore fspms.jks -deststorepass superPASSWORD -destalias fspms -destkeypass superPASSWORD -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass srcpassword -srcalias server</li></ul><ol start="2"><li>You are replacing certificate in "fspms.jks" so following message will appear:</li></ol><ul><li>Existing entry alias server exists, overwrite? [no]:</li></ul><ol start="3"><li><b>Type </b>"yes" and <b>hit</b> enter</li><li><b>Type </b>the following command to restart the Policy Manager server to start using the new certificate:</li></ol><ul><li>/etc/init.d/fspms restart</li></ul><p>Article no: 000004509</p>
</article>
</main>