Enabling SSL in OpManager Plus

Steps to enable SSL for OpManager Plus build 8050 and above 

In build 8050 we have removed Apache from OpManager Plus.  Follow the steps given below to enable SSL:

1. Open a command prompt (Run > cmd) and change directory to /opmanagerPlus/bin.
2. Execute the following command
   ssl_gen.bat -f Enable

You have successfully enabled self signed SSL certificate for OpManager Plus. Now you can access OpManager Plus web client in the same port number with https://.

Steps to disable SSL:

Open a command prompt (Run > cmd) and change directory to /opmanagerPlus/bin.

Execute the following command
ssl_gen.bat Disable

This will disable SSL for OpManager Plus. The web client can be accessed in the same port number with  http://.

Steps to enable SSL for NetFlow plug-in

Steps to enable SSL:

• Open a command prompt (Run > cmd) and change directory to /opmanagerPlus/NetFlow/bin.
• Execute the following command

      ssl_gen.bat -f Enable

Steps to disable SSL:

• Open a command prompt (Run-> cmd) and change directory to /opmanagerPlus/NetFlow/bin..
• Execute the following command

      ssl_gen.bat Disable

Steps to enable third-party SSL in OpManager Plus

1. Open a command prompt (Run > cmd) and change directory to /opmanagerPlus.
2. Generate a Keystore file. Execute the following command and provide requested details to create OpManagerPlus.truststore
   file under conf folder.
   >jrebin\keytool.exe -v -genkey -keyalg RSA -keystore confOpManagerPlus.truststore -alias opmanagerPlus   (Press Enter)                                                         (OR)                                                 
    >jre\bin\keytool.exe -v -genkey -keyalg RSA -keystore conf\OpManagerPlus.truststore -alias opmanagerPlus  -keysize 2048   (for 2048 bit key)               Enter keystore password:(Enter a password for this keystore. atleast 6 characters long. Press Enter)
   What is your first and last name?
   [Unknown]: (Enter the Server's name in which OpManagerPlus is running. It must be a FQDN [Fully Qualified Domain Name] Ex.: opmserver.manageengine.com. Press Enter.)
   What is the name of your organizational unit?
   [Unknown]: (Name of your Organization Unit. Ex: SYSADMIN. Press Enter.)
   What is the name of your organization?
   [Unknown]: (Your Organization Name. Ex:Zoho Corp. Press Enter.)
   What is the name of your City or Locality?
   [Unknown]: (Your city name. Ex:Pleasanton. Press Enter.)
   What is the name of your State or Province?
   [Unknown]: (Your state name. Ex:California. Press Enter.)
   What is the two-letter country code for this unit?
   [Unknown]: (Your country's two letter code. Ex:US. Press Enter.)
   Is CN=opmserver.manageengine.com, OU=SYSADMIN, O=Zoho Corp, L=Pleasanton, ST=California, C=US correct?
   [no]: (Check the details and if it is correct type yes and press enter. If else just press Enter to modify)
   Generating 1,024 bit RSA key pair and self-signed certificate (MD5WithRSA)
   for CN=opmserver.manageengine.com, OU=SYSADMIN, O=Zoho Corp, L=Pleasanton, ST=California, C=US
   Enter key password for <opmanagerPlus>
   (RETURN if same as keystore password): (Just press enter. For tomcat both keystore password and key [alias] password must be the same)
   [Storing confOpManagerPlus.truststore]
   
3. Generating CSR File (Certificate Signing Request). Execute the following commands to create opmssl.csr file under conf folder:
   >jre\bin\keytool.exe -v -certreq -file conf\opmssl.csr -keystore conf\OpManagerPlus.truststore -alias opmanagerPlus
   Enter keystore password: (Enter the password for the keystore file)
   Certification request stored in file <confopmssl.csr>
   Submit this to your CA
4. Get certificates from CA (Certification Authority):
   Contact a CA like Verisign, Equifax, with the csr file generated in the previous step to get ssl certificate. Mostly you have to copy and paste the content of the csr file in a text area of their website. After verifying your request, mostly they will sent you the certificate content through mail. Copy and paste the content in a text editor and save it as "ServerCert.cer" under OpManagerPlus_Homeconf folder. Be cautious that while doing copy-paste, no extra space added at the end of lines.
5. Import root and intermediate certificates:
   Before importing our certificate, we have to import the CA's root and intermediate certificates into the keystore file we generated at the second step. While mailing you the certificate, CA's will mention the link to their root and intermediate certificates. Save them under conf directory in the name "CARoot.cer" and "CAIntermediate.cer" respectively. Some CAs may have two or more intermediate certificates. Refer their document clearly before importing.
   
   To import root certificate:
   >jre\bin\keytool.exe -import -trustcacerts -file conf\CARoot.cer -keystore conf\OpManagerPlus.truststore -alias CARootCert
   Enter keystore password: (Enter the keystore password)
   (Root Certificate's information will be printed)
   Trust this certificate? [no]: (type yes and press enter if it is the certificate of your CA)
   Certificate was added to keystore
   
   To import intermediate certificate:
   >jre\bin\keytool.exe -import -trustcacerts -file conf\CAIntermediate.cer -keystore conf\OpManagerPlus.truststore -alias CAInterCert
   Enter keystore password: (Enter the keystore password)
   Certificate was added to keystore
    
6. Import Server's Certificate. Execute the following command to add the certificate received from CA to the keystore file:
   >jre\bin\keytool.exe -import -trustcacerts -file conf\ServerCert.cer -keystore conf\OpManagerPlus.truststore -alias opmanagerPlus
   Enter keystore password: (Enter the keystore password)
   Certificate reply was installed in keystore
   
7. Configure Tomcat:
   1. Open "ssl_server.xml" file (under OpManagerPlus_Hometomcatconfbackup) in a text editor.
   2. Search for term "keystoreFile". It will be an attribute for connector tag. Set the value as
      "WEBNMS_ROOT_DIR/conf/OpManagerPlus.truststore".
   3. Change the value for "keystorePass" attribute
      with your keystore file password.
8. Modify conf file:
   1. Open "OpManagerPlusStartUp.properties" file (under OpManagerPlus_Homeconf) in a text editor.
   2. Set the value of the parameter "https" as "Enable".
9. Start OpManager Plus server. Connect client with https. Ex:https://opmserver:80

Note:
If you are already having a certificate for this server and that certificate was requested by the keystore file generated using Java keytool, you may use it for SSL configuration. Just copy and paste the keystore file under OpManagerPlus_Homeconf and rename it to “OpManagerPlus.truststore” and follow the steps from 5.

(Provide full path of  conf\OpManagerPlus.truststore ex: c:\ProgramFiles\Manageengine\OpManagerPlus\conf\OpManagerPlus.truststore  instead of conf\OpManagerPlus.truststore on all locations above)