Configuring SSL communications

By default, Common Services use SSL/TLS communications. Immediately after installation, the system uses SSL
communication by using a self-signed certificate. However, you must set up SSL communications to use a valid server
certificate before any of the products can communicate with the Common Services and the Hitachi Ops Center Portal.

Depending on your environment, you can set up SSL by using one of the following methods:

• If your Hitachi Ops Center products are running on the same management server, you can follow the simplified
procedure described in Configuring SSL by using the CLI Setup Tool.
• If your Ops Center products are running on multiple servers, you must set up SSL manually by using various
commands as described in Configuring SSL for a multi-server configuration.

Configuring SSL communications for a multi-server configuration

The following figure shows the workflow for configuring SSL communications in Common Services and each product:

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
1
Preparing the server certificate for Common Services

Prepare the server certificate for Common Services. Common Services supports both RSA and Elliptic Curve Digital
Signature Algorithm (ECDSA). You cannot configure only ECDSA. Prepare secret keys and server certificates for RSA
only or for both RSA and ECDSA.
NoteIf you configure both RSA and ECDSA in Common Services, RSA will be used for communication with Hitachi Ops
Center Automator. ECDSA will be used for communication with other products.

1. Log in to the management server as the root user.

If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.

2. Run the following command to create a private key (in X.509 PEM format) and a certificate signing request (CSR).

◦ Example of the command for RSA:

installation-directory-of-Common-Services/openssl/bin/openssl req -new -newkey rsa:4096 -nodes -

keyout privateRSA.pem -sha256 -out serverRSA.csr -subj "/C=US/ST=xx/L=yy/O=zz/CN=host-name-
or-IP-address" -addext 'subjectAltName = {DNS:host-name|IP:IP-address|DNS:host-name,IP:IP-
address}' -config installation-directory-of-Common-Services/openssl/openssl.cnf

◦ Example of the command for ECDSA:

installation-directory-of-Common-Services/openssl/bin/openssl req -new -newkey ec:<(installation-

directory-of-Common-Services/openssl/bin/openssl ecparam -name secp384r1) -nodes -keyout
privateECDSA.pem -sha256 -out serverECDSA.csr -subj "/C=US/ST=xx/L=yy/O=zz/CN=host-name-
or-IP-address" -addext 'subjectAltName = {DNS:host-name|IP:IP-address|DNS:host-name,IP:IP-
address}' -config installation-directory-of-Common-Services/openssl/openssl.cnf

When running the command, specify parameters according to the Cipher Suite supported by Common Services.
For details on the Cipher Suite supported by Common Services, see the Common Services Release Notes.

Specify /C=US/ST=xx/L=yy/O=zz according to your environment. For CN, specify a host name (or FQDN) or
IP address that can be used to access the Hitachi Ops Center Portal.

If you specified a host name for CN, specify DNS:host-name for subjectAltName. If you specified an IP
address for CN, specify IP:IP-address for subjectAltName. If you specified a host name for CN, and
specified that an IP address can also be used to access the Hitachi Ops Center Portal, specify DNS:host-
name,IP:IP-address for subjectAltName.

To create a CSR by using the openssl command in the installation directory of Common Services, you will need to
specify the -config option to load the settings file.

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
2
 3. Run the following command to check the results of creating the CSR.

installation-directory-of-Common-Services/openssl/bin/openssl req -text -in server-certificate-file

4. Request the certificate authority to issue the signed certificate.

5. After acquiring a server certificate signed by the certificate authority, run the following command to check the
results of creating the server certificate.

installation-directory-of-Common-Services/openssl/bin/openssl x509 -text -in server-certificate-signed-by-

certificate-authority

Setting the path information of the server certificate and private key

In the Common Services configuration definitions file, specify the settings for the signed server certificate acquired from
the certificate authority and the settings for the private key.

Before you begin

Concatenate the signed server certificate acquired from the certificate authority and the certificate from the intermediate
certificate authority into a single file as follows. If there are multiple certificates from intermediate certificate authorities,
concatenate all certificates in a chain.

cat server-certificate-signed-by-certificate-authority certificate-from-an-intermediate-certificate-authority

[certificate-from-an-intermediate-certificate-authority ...] > chained-server-certificate

Procedure

1. Log in to the management server as the root user.

If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.

2. Transfer the signed server certificate acquired from the certificate authority and the private key to the management
server in a secure manner.

3. Store the server certificate and the private key in the following location:

user-data-directory/tls/

4. In the following configuration definitions file, specify the absolute paths to the server certificate file and private key
file, and then save the file.

◦ Definitions file location

user-data-directory/userconf/config_user.properties

◦ Settings

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
3
 ▪ RSA settings:

CS_GW_SSL_CERTIFICATE = absolute-path-of-the-certificate-(RSA)-file
CS_GW_SSL_CERTIFICATE_KEY = absolute-path-of-the-private-key-(RSA)-file

▪ ECDSA settings:

CS_GW_SSL_CERTIFICATE_ECDSA = absolute-path-of-the-certificate-(ECDSA)-file
CS_GW_SSL_CERTIFICATE_KEY_ECDSA = absolute-path-of-the-private-key-(ECDSA)-file

5. Restart the Common Services service.

NoteIn an environment where SSL communication settings have already been configured, if you want to change
the settings in config_user.properties by adding ECDSA settings or reissuing a server certificate, complete the
following procedures to configure SSL communication by configuring the settings for each product and Common
Services, and then restarting the Common Services service. If you restart the Common Services service before
configuring the settings, a communication error might occur.

Specifying the SSL server settings for each product

Configure SSL communications for each product that links with Common Services. As you did with Common Services,
you must prepare the signed certificate from the certificate authority, and specify the SSL server settings.

For details on how to specify the SSL server settings, see the documentation for each product.

Specifying the SSL server settings for an Active Directory server

To use LDAPS for communication, specify a server certificate and a private key on the Active Directory server. For
details on how to specify these settings, see the Active Directory server documentation.

Specifying the SSL server settings for an identity provider server

To link with an identity provider, specify the SSL server settings on the AD FS server. For details on how to specify the
settings, see the AD FS server documentation.

Importing certificates into each product

Import the root certificate of the server certificate for Common Services into each product that links with Common
Services. In addition, if you import the Common Services metadata into AD FS over the network when configuring a
linkage with an identity provider, import the root certificate of the server certificate for Common Services into the AD FS

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
4
server. In some cases, the certificate might have already been imported. In this case, you do not need to import the
certificate.
NoteIf you want to configure both RSA and ECDSA in Common Services, import the RSA root certificate into Hitachi
Ops Center Automator. Import the ECDSA root certificate into other products.

For details on how to import a certificate, see the documentation for each product.

Importing certificates into the Common Services truststore

You can import the root certificate of the server certificate for Common Services into the Common Services truststore,
as well as the root certificate of the server certificate for each product and for the Active Directory server.

Before you begin

Transfer the certificates to the management server in a secure manner.

Procedure

1. Log in to the management server as the root user.

If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.

2. Run the following command to import the root certificate of the server certificate for Common Services into the
truststore.

In some cases, the certificate might have already been imported. In this case, you do not need to complete this
step.

◦ Format

keytool -importcert -alias alias-name -keystore path-to-truststore-file -storetype jks -storepass

password-of-truststore-file -file path-of-the-certificate-to-be-imported

◦ Options

▪ -alias alias-name

Specify the name so that the certificate can be identified in the truststore.

▪ -keystore path-to-truststore-file

Specify the following absolute path as the path to the truststore file:

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
5
 user-data-directory/tls/cacerts

▪ -storepass password-of-truststore-file

Specify the password of the truststore file. The default password is changeit.
NoteWe recommend that you change the truststore password.

▪ -file path-of-the-certificate-to-be-imported

Specify the absolute path of the certificate to import.

3. In the same way, import the root certificate of the server certificate for each product into the truststore.

4. When you use LDAPS for communication with the Active Directory server, import the root certificate of the server
certificate for the Active Directory server.

5. If you link Common Services with an identity provider, import the root certificate of the server certificate for the
identity provider server.

6. Restart the Common Services service and the services for each product.
For details on how to restart the Common Services service, see Starting or stopping the Common Services
service. For details on how to restart the service of each product, see the documentation for each product.

Enabling server certificate verification

Immediately after you install Common Services, server certificates for communication partners are not verified when
Common Services is the SSL client. Therefore, to strengthen security, you enable certificate verification immediately so
that all server certificates are verified and your environment is protected from threats such as spoofing.

1. Log in to the management server as the root user.

If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.

2. Change the following property file to enable server certificate verification:

◦ Property file location

user-data-directory/userconf/config_user.properties

◦ Setting

CS_PORTAL_SSL_CERTIFICATE_CHECK = true

3. Restart the Common Services service.

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
6
Configuring SSL for a single management server by using the CLI setup
tool
Use the cssslsetup command, you can create a single private key and server certificate for all Hitachi Ops Center
products installed on the same management server:

• Hitachi Ops Center Common Services

• Hitachi Ops Center Automator
• Hitachi Ops Center Analyzer
• Hitachi Ops Center Analyzer detail view
• Hitachi Ops Center Analyzer viewpoint
• Hitachi Ops Center Administrator
• Hitachi Ops Center Protector (Master)
• Hitachi Ops Center API Configuration Manager

The following settings are not configured by the cssslsetup command:

• Settings for SSL communications with products that are installed on a server other than the management server
• Settings of the SSL server for storage systems and the Active Directory server
• SSL communications settings for the Analyzer probe server and Protector clients

Configure them as necessary by referring to the manual for each product.

Functions provided by the cssslsetup command

The cssslsetup command provides the following functions.

• Creating a private key and a certificate signing request (CSR)

The cssslsetup command creates a common private key and CSR that can be used by all products.
NoteThis command only supports the RSA encryption algorithm. If you want to use both RSA and the Elliptic Curve
Digital Signature Algorithm (ECDSA), do not use the cssslsetup command.

• Specifying the SSL server settings

cssslsetup command specifies the settings for operating as the SSL server.

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
7
 Product Settings

Common Services Registering the server certificate and private key

◦ Registering the server certificate and private key

Automator ◦ Enabling SSL communications

◦ Registering the server certificate and private key

Analyzer ◦ Enabling SSL communications

Analyzer detail view Importing the server certificate (in the PKCS#12 format) into the keystore

Analyzer view point Registering the server certificate and private key

Administrator Registering the server certificate and private key

Protector Registering the server certificate and private key

◦ Registering the server certificate and private key

API Configuration
Manager ◦ Configuring notifications for storage system configuration changes

• Specifying the SSL client settings and enabling the certificate verification function

cssslsetup command specifies the SSL communication settings, and enables the certificate verification function.

Product Settings

◦ Importing the root certificate into the truststore

◦ Importing the root certificate of the server certificate for the Active Directory server
Common Services (including the Active Directory Federation Services server) into the truststore
◦ Enabling the certificate verification function

◦ Importing the root certificate into the truststore

Automator ◦ Importing the root certificate of the server certificate for the Active Directory server

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
8
 Product Settings

into the truststore

◦ Enabling the certificate verification function

◦ Importing the root certificate into the truststore

◦ Importing the root certificate of the server certificate for the Active Directory server
Analyzer into the truststore
◦ Enabling the certificate verification function

Importing the Active Directory server certificate into the truststore

Analyzer detail view NoteTo link with Active Directory, you need to add an active directory user by using the
Analyzer detail view.

Analyzer view point None

None
Note
◦ You must use the setupcommonservice command for the following tasks:
▪ Import the root certificate into the truststore.
Administrator ▪ Enable the certificate verification function.
◦ If you want to link with Active Directory, you must import the certificate of the Active
Directory server into the truststore and register an Active Directory domain that
uses the DNS server. For the configuration procedure, see the Administrator
manual.

Importing the root certificate into the truststore

Protector NoteYou must use the setupcommonservice command to enable the certificate
verification function.

◦ Specifying the certificate verification settings for storage systems

API Configuration
Manager ◦ Enabling SSL communications

• Enabling or disabling the certificate verification function

You can enable or disable the certificate verification function for maintenance of SSL communications.

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
9
Creating a private key and a certificate signing request (cssslsetup)

Use the cssslsetup command to create a private key and a certificate signing request (CSR) used by all Hitachi Ops
Center products.

1. Log in to the management server as the root user.

If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.

2. Run the cssslsetup command, which is in the following location:

installation-directory-of-Common-Services/utility/bin

The main menu is displayed:

Main menu
1. Create certificate signing request and private key.
2. Set up SSL server.
3. Set up SSL client.
4. Enable/disable certificate verification(optional).
5. Restart services for each product.
Enter a number or q to quit:

3. Select 1. You are prompted to provide the required certificate information. When prompted, enter the following:
◦ Absolute path to the file where the shared private key is output.
◦ Absolute path to the file where the CSR is output.
◦ Signature algorithm for RSA.
◦ Key size.
◦ Host name.
◦ Organizational unit.
◦ Organization name.
◦ Name of the city or locality.
◦ Name of the state or province.
◦ 2-letter country code.
◦ Host name (or FQDN), IP address or both of SubjectAltName.

4. Make sure that the settings are correct. If they are correct, select 1. Yes. If you want to specify the settings again,
select 2. No (Cancel) to return to the main menu.

5. When the CSR is successfully created, the results are displayed and the main menu reappears. Select q to exit.

6. Request the certificate authority to issue the signed certificate.

7. After acquiring the server certificate signed by the certificate authority, run the following command to check the
results:

installation-directory-of-Common-Services/openssl/bin/openssl x509 -text -in full-path-of-the-certificate-file

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
10
Configuring SSL server settings (cssslsetup)

Use the cssslsetup command to set the server certificate and the private key for the Hitachi Ops Center products on the
management server.

1. Log in to the management server as the root user.

If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.

2. Run the cssslsetup command, which is in the following location:

installation-directory-of-Common-Services/utility/bin

The main menu is displayed:

Main menu
1. Create certificate signing request and private key.
2. Set up SSL server.
3. Set up SSL client.
4. Enable/disable certificate verification(optional).
5. Restart services for each product.
Enter a number or q to quit:

3. Select 2.

4. Specify the target product for which you want to configure the SSL server.
Use commas to specify multiple products.

5. Specify an absolute path to the file where the shared private key is located.

6. Specify an absolute path to the file where the shared server certificate is located.

7. Specify whether the server certificate specified is issued by the intermediate certificate authority.

8. If you specified yes in step 7, specify the absolute path of the certificate of the intermediate certificate authority.

9. To specify settings for Hitachi Ops Center Analyzer detail view or Hitachi Ops Center API Configuration Manager,
specify, use an absolute path to specify the file name of the root certificate of the server certificate for use with all
Hitachi Ops Center products.

10. Specify the host name specified when creating the CSR.

11. To specify settings for Hitachi Ops Center Analyzer or Hitachi Ops Center Automator and ECC encryption
certificate settings are enabled, specify whether to leave the ECC encryption certificate settings enabled.

12. To specify settings for Hitachi Ops Center Administrator, specify the port number.

13. To specify settings for Hitachi Ops Center Administrator, specify the virtual appliance manager credentials.

14. To specify settings for Hitachi Ops Center Analyzer detail view, specify the following password:

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
11
 ◦ KeyStorePassword / TrustStorePassword: Common password for the truststore and the keystore.
◦ KeyManagerPassword: Password for the key manager.

15. To implement the SSL server settings, select 1. Yes.

After the settings are implemented, a message is displayed and the main menu reappears.

16. Select 5 to restart the services for each product.

Configuring SSL client settings and enabling the certificate verification function
(cssslsetup)

Use the cssslsetup command to configure the required SSL client settings on the management server and enable the
certificate verification function.

1. Log in to the management server as the root user.

If you log in as an ordinary user, use the sudo command to complete the following procedure as the root user.

2. Run the cssslsetup command, which is in the following location:

installation-directory-of-Common-Services/utility/bin

The main menu is displayed:

Main menu
1. Create certificate signing request and private key.
2. Set up SSL server.
3. Set up SSL client.
4. Enable/disable certificate verification(optional).
5. Restart services for each product.
Enter a number or q to quit:

3. Select 3.

4. Specify the target product for which you want to configure SSL client settings.
Use commas to specify multiple products.

5. Import the root certificate for common use.

1. Specify an absolute path to the file where the root certificate is located.
If you only want to configure the settings for linking with Active Directory or Active Directory Federation
Services, press Enter without specifying anything.

2. When the truststore file name is displayed, specify the truststore password.

3. Specify the alias name (server identification name).

If the truststore includes the same alias name, you are prompted as to whether you want to reregister the
alias name appears. If necessary, reregister it.

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
12
 6. If you want to link with Active Directory or Active Directory Federation Services, import the certificate for the Active
Directory server or the Active Directory Federation Services server.

1. Specify, as an absolute path, the file name of the certificate for the Active Directory server or the Active
Directory Federation Services server.
If you do not want to link with Active Directory or Active Directory Federation Services, press Enter without
specifying anything.

2. When the truststore file name is displayed, specify the truststore password.

3. Specify the alias name (server identification name).

If the truststore includes the same alias name, you are prompted as to whether you want to reregister the
alias name appears. If necessary, reregister it.

7. For Hitachi Ops Center API Configuration Manager, configure SSL communications with your storage systems.

1. If you want to configure SSL communications, select 1. Yes.

2. Specify the storage device ID of the target storage system and use an absolute path for the server certificate.

3. To configure SSL communications for additional storage systems, select 1. Yes. If not, select 2. No.

4. Continue this procedure until you have registered all your storage systems.

8. Specify whether to enable the certificate verification function.

9. To implement the SSL client settings, select 1. Yes.

After the settings are implemented, a message is displayed and the main menu reappears.

10. Select 5 to restart the services for each product.

https://knowledge.hitachivantara.com/Documents/Management_Software/Ops_Center/10.6.x/Get_Started_with_Ops_Center/…
Updated: Fri, 10 Dec 2021 20:30:43 GMT
Powered by
13