Enable WBEM Certificate Validation

By default, all WBEM transactions are encrypted, but the identity of the managed node is not validated. Certificates passed from target nodes are automatically trusted. Enabling certificate validation will increase the level of security for WBEM transactions. You can use self-signed certificates for medium security or CA-signed certificates for high security. The certificate manager inspects credentials for each transaction and either approves or denies the WBEM data exchange based on the credentials.

This security enhancement uses the Java keytool from Sun Microsystems. For more information on the keytool, go to http://java.sun.com and search for summary of security tools.




	NOTE: Additional information about HP WBEM Services is available on the Web at: `http://docs.hp.com/hpux/netsys/index.html`

You can use:

self-signed certificates for a medium security level
CA-signed certificates for a high security level

The self-signed certificates are generated by WBEM on each managed node when SSL is enabled. See the appropriate procedure to enable WBEM certificate validation for your certificate type.

Procedure 4-2 To enable WBEM certificate validation with self-signed certificates:

Log on to the CMS as root.
Identify the MxKeystorePassword:
mxpassword -l -x MxKeystorePassword
Create a copy the self-signed certificate on a managed node:
/opt/wbem/sbin/openssl x509 -in /var/opt/wbem/server.pem -out node.cer
where node is the hostname of the managed node.
Securely copy the certificate to the /etc/opt/mx/config/security/ directory on the CMS.
Import the certificate into the trust store on the CMS:
keytool - import -alias node -file node.cer -keystore /etc/opt/mx/config/security/certificates -keypass password
where node is the hostname of the managed node and password is the MxKeystorePassword.
Repeat this process for each managed node running WBEM.
Edit the WBEM configuration files on the CMS to enable certificate validation. The files are located at:
- /opt/hpwebadmin/bin/cim.properties
- /etc/opt/mx/config/collectors/cimclient.properties
Comment out the following line that sets the trust manager in each file.
TrustManager=orig.snia.wbemcmd.xml.DontValidateCertificate
Restart SCM and Tomcat on the CMS:
/opt/mx/bin/mxstop
/opt/mx/bin/mxstart

Procedure 4-3 To enable WBEM certificate validation with CA-signed certificates:




	NOTE: You must have a certificate server available on the network to use CA-signed certificates.

Log on to the CMS as root.
Identify the MxKeystorePassword:
mxpassword -l -x MxKeystorePassword
Generate a CA-signed certificate on the certificate server, save it as ca_certificate.cer.
Securely copy the generated CA certificate to the /etc/opt/mx/config/security/ directory on the CMS.
Import the CA-signed certificate into the trust store on the CMS:
keytool -import -alias caroot -file ca_certificate.cer -keystore /etc/opt/mx/config/security/certificates -keypass password
where password is the MxKeystorePassword.
On a managed node that is running WBEM, generate a certificate request to be signed by CA on the certificate server.
/opt/wbem/sbin/openssl req -new -key /var/opt/wbem/server.pem -out cert.csr -config /var/opt/wbem/ssl.cnf
Securely copy the generated certificate request from the managed node to the certificate server.
Retrieve the signed certificate in base64 x509 format.
Replace the certificate on the managed node with the new certificate generated from the certificate server. The certificate on each node is at /var/opt/wbem/server.pem.
Restart WBEM on the managed node:
kill -9 cimserver_pid
Repeat steps 6-10 for each managed node running WBEM.
Edit the WBEM configuration files on the CMS to enable certificate validation. The files are located at:
- /opt/hpwebadmin/bin/cim.properties
- /etc/opt/mx/config/collectors/cimclient.properties
Comment out the following line that sets the trust manager in each file.
TrustManager=orig.snia.wbemcmd.xml.DontValidateCertificate
Restart SCM and Tomcat on the CMS:
/opt/mx/bin/mxstop
/opt/mx/bin/mxstart

Enable WBEM Certificate Validation

Technical documentation

» Table of Contents

» Glossary

» Index