Configure and Customize Dell PowerFlex v3.6.x

Replace the default self-signed security certificate with your own trusted certificate

Create your own trusted certificate, and then replace the default certificate with the one that you created.

1. Find the location of keytool on your server.
   It is a part of the Java (JRE or JDK) installation on your server, in the bin directory. For example: /usr/bin/keytool
2. Generate your RSA private key:

   keytool -genkey -alias <YOUR_ALIAS> -keyalg RSA -keystore <PATH_TO_NEW_KEYSTORE_FILE>

   NOTE:For <PATH_TO_NEW_KEYSTORE_FILE>, specify a nonexistent file under the /etc/mgmt-server/.config directory, for example /etc/mgmt-server/.config/mgmt-server.jks.
   1. You will be prompted for a keystore and private key passwords. If you want to define a password without being prompted, add the following parameters to the command. Use the same password for both parameters.

      -storepass <KEYSTORE_PASSWORD> -keypass <KEYSTORE_PASSWORD> 

3. Generate a Certificate Signing Request (CSR) by typing the following command:
   If you omit the password flags, you will be prompted for the keystore and private key passwords.

   keytool -certreq -keyalg RSA -alias <YOUR_ALIAS> -file certreq.txt -keystore <PATH_TO_NEW_KEYSTORE_FILE> -storepass <KEYSTORE_PASSWORD> -keypass <KEYSTORE_PASSWORD> -keypass <PRIVATE_KEY_PASSWORD>

4. Use the CSR to obtain a new certificate from a third-party trusted SSL certificate provider (CA).
   The CA returns the following files:

   • A certificate for the Presentation Server
   • Trusted root and possibly one or more intermediate certificates from the CA

   NOTE:The certificates must be in PEM format.

   Save the certificate files on your server.
5. Concatenate all the provided certificates into one file.

   cat <LOCATION_OF_SIGNED_SSL_CERTIFICATE_FILE> [<LOCATION_OF_YOUR_INTERMEDIATE_CA_CERTIFICATE_FILE> ...] <LOCATION_OF_YOUR_ROOT_CA_CERTIFICATE_FILE> mgmt-server-chain.crt

6. Install the SSL certificate chain under the same alias of the CSR in step three.
   If you omit the password flags, you will be prompted for the keystore and private key passwords.

   keytool -importcert -alias <YOUR_ALIAS> -keystore <PATH_TO_NEW_KEYSTORE_FILE> -file mgmt-server-chain.crt -storepass <KEYSTORE_PASSWORD> -keypass <PRIVATE_KEY_PASSWORD>

7. Edit the Management Server configuration file, /etc/mgmt-server/.config/mgmt-server.
   1. If the file does not exist, create it.
   2. If the file already contains the MGMT_SERVER_OPTIONS parameter, add the keystore-related parameters to any existing ones.
      NOTE:For the value of backend.httpd.keystoreResource specify the keystore file name, without the directory. For example, if the path of the keystore file is /etc/mgmt-server/.config/mgmt-server.jks.use mgmt-server.jks.

      MGMT_SERVER_OPTIONS='backend.httpd.keystoreResource=<FILE_NAME_OF_NEW_KEYSTORE_FILE> backend.httpd.keystorePassword=<KEYSTORE_PASSWORD> backend.httpd.keyManagerPassword=<PRIVATE_KEY_PASSWORD>'

8. Restart the PowerFlex presentation server service. Type the following command:

   service mgmt-server restart

   Replacement of the security certificate is complete.