Configuring the SSL Certificate for Tomcat Server

To configure SSL on the Tomcat server for the Command Center, Web Console, or Compliance Search, you must create a certificate and then configure the SSL connector.

Before You Begin

Create a Certificate.

Note

Self-signed certificates are automatically created and installed by the Commvault software. If you use a self-signed certificate, users will see a warning in the browser indicating that it is not safe to proceed.
If you use a Custom Report Engine and you want to configure SSL on a port other than 443, you must add the customreportengineurl additional setting. For more information, see Configuring an Alternate Port for SSL for the Custom Report Engine.
To support stronger encryption when establishing the SSL connection, add the Djdk.tls.ephemeralDHKeySize=2048 setting to the startup option of the Tomcat service. This setting is enabled by default on Command Center, Web Console, and Compliance Search computers that are installed with Version 11 SP9 or later service packs.

Where to Perform This Task

For Command Center, perform this task on the Command Center computer.
For Web Console, perform this task on the Web Console computer.
For Compliance Search, perform this task on the Compliance Search computer.

Procedure

Stop the Tomcat Server.
Go to software_installation_path/Apache/Conf, and then back up the server.xml file that is part of the Apache configuration.
Copy the generated keystore file to software_installation_path/Apache.
For new installations of Version 11 SP9 or higher, in the server.xml file, modify the path to the generated keystore file and the keystore password values:
```
 
<Certificate certificateKeystoreFile="software_installation_path/Apache/your_file" certificateKeystorePassword="Password" certificateKeystoreType="JKS"/> 
```
where:
- certificateKeystoreFile is the path to your keystore file. You can use the .jks keystore file and set the certificateKeystoreType to JKS. You can also use the .pfx,.p12 or .p7b keystore files and set certificateKeystoreType to PKCS12.
- certificateKeystorePassword is the password that you used to create the keystore or certificate.
For configuration on SP8 or earlier installations, refer to the corresponding service pack version documentation.
In the server.xml file Connector element associated with port 443, keep the following up to date:
- SSL protocols: Update the SSLHostConfig element protocols attribute (enable TLSv1.2 and higher).
- Ciphers: Update the SSLHostConfig element ciphers attribute according to your corporate security policy. For a list of ciphers that are considered reasonably secure at this time, see Ciphers for the SSL Connector for Tomcat Server.
```
<SSLHostConfig certificateVerification="none" honorCipherOrder="true" protocols="TLSv1.2" ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA">
```
Additional configurations for the Web Console:
- If you want all users to use a secured channel, on the Web Console computer add the forceHttps additional setting.
  
  Note
  
  For new installations of Version 11 SP9 or higher, the forceHttps additional setting is enabled by default.
  
  For instructions on adding the additional setting from the CommCell Console, see Adding or Modifying Additional Settings from the CommCell Console.
  
  Property
  
  Value
  
  Name
  
  forceHttps
  
  Category
  
  WebConsole
  
  Type
  
  BOOLEAN
  
  Value
  
  True
  
  Note
  
  If the Web Server and Web Console computers are separated by a firewall, you must configure third-party ports mapping to open connections to the Web Server through the Web Console computer. For more information, see Configuring Access to the Web Server Using TPPM.
- Update the URL for the link to the Web Console. For more information, see Linking to the Web Console from the CommCell Console.
Start the Tomcat Server and access the resource on your server using HTTPS.

For instructions on restarting the Tomcat service, see Restarting a Service.

Property	Value
Name	forceHttps
Category	WebConsole
Type	BOOLEAN
Value	True

What to Do Next

For Compliance Search, configure HTTPS for the Compliance Search Link from the Web Console.