8.1 Enabling a Secure Connection

A secure connection requires certificate authentication between the Cloud Manager Application Server and the Cloud Manager Orchestration Server.

The first time it is started, the Cloud Manager Web Service creates a keystore, generates a public/private key pair, and exports the public key to a certificate. The Web Service is started automatically as part of the Cloud Manager Orchestration Server startup or manually by using the following command:

/etc/init.d/novell-pso-ws start

To complete the configuration of the secure connection, you need to import the Cloud Manager Web Service’s public certificate to the Cloud Manager Application Server trust store and configure the secure port for the Cloud Manager Web Service. The following sections provide instructions:

8.1.1 Configuring the Cloud Manager Web Service Secure Port

By default, the Cloud Manager Web Service listens on port 8443. You can change this port if necessary.

On the Cloud Manager Orchestration Server, open the jetty-ssl.xml file:

/etc/opt/novell/pso-ws/jetty/jetty-ssl.xml

Locate the <Call name ="addConnector"> section. It will look similar to the section shown below:

<Call name="addConnector">
  <Arg>
    <New class="org.mortbay.jetty.security.SslSocketConnector">
      <Set name="Port">8443</Set>
      <Set name="maxIdleTime">30000</Set>
      <Set name="handshakeTimeout">2000</Set>
      <Set name="keystore"><SystemProperty name="jetty.home" default="." 
        />/etc/keystore</Set>
      <Set name="password">OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4</Set>
      <Set name="keyPassword">OBF:1u2u1wml1z7s1z7a1wnl1u2g</Set>
      <Set name="truststore"><SystemProperty name="jetty.home"
        default="." />/etc/keystore</Set>
      <Set name="trustPassword">OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4</Set>
      <Set name="handshakeTimeout">2000</Set>
    </New>
  </Arg>
</Call>

In the <Set name="Port"> directive, change the port number.

When adding the Cloud Manager Orchestration Server as a zone in the Cloud Manager Application Console, you specify this port as the server port.
Save the jetty-ssl.xml file.
Restart the Cloud Manager Web Service:

/etc/init.d/novell-pso-ws restart

8.1.2 Disabling SSL v3 in Java Jetty

Cloud Manager automatically disables the SSL v3 protocol in Java Jetty on the Cloud Manager Application Server, thereby addressing the vulnerability to potential POODLE (Padding Oracle On Downgraded Legacy Encryption) attacks. For more information about POODLE, see Common Vulnerabilities and Exposures CVE-2014-3566.

If you need to disable SSL v3 in Java Jetty on your existing Cloud Manager Application Server, you must manually modify the /opt/netiq/cloudmanager/deploy/jetty/etc/jetty.xml file:

Navigate to the /opt/netiq/cloudmanager/deploy/jetty/etc/jetty.xml file and save a copy as jetty-xml-OLD.
Open the jetty.xml file in a text editor.

If SSL is enabled, the jetty.xml file contains a section that looks like the following. Delete this section from the file.

NOTE:You must remove the old section. Commenting it out can cause the configuration script to fail when you perform an upgrade.

<Call name="addConnector">
  <Arg>
    <New class="org.eclipse.jetty.server.ssl.SslSelectChannelConnector">
      <Set name="Port">[SSL Port Number]</Set>
      <Set name="maxIdleTime">120000</Set>
      <Set name="keystore">
        <SystemProperty name="karaf.home" default="." />[Keystore File Name]
      </Set>
      <Set name="password">[Keystore Password]</Set>
      <Set name="keyPassword">[Key Password]</Set>
      <Set name="wantClientAuth">true</Set>
    </New>
  </Arg>
</Call>

Replace the old section of the jetty.xml file with the following:

<Call name="addConnector">
  <Arg>
    <New class="org.eclipse.jetty.server.ssl.SslSelectChannelConnector">
      <Arg>
        <New class="org.eclipse.jetty.http.ssl.SslContextFactory">
          <Set name="keyStore">
            <SystemProperty name="karaf.home" default="." />
            [Keystore File Name]
          </Set>
          <Set name="keyStorePassword">[Keystore Password]</Set>
          <Set name="keyManagerPassword">[Key Password]</Set>
          <Set name="ExcludeProtocols">
            <Array type="java.lang.String">
              <Item>SSLv3</Item>
            </Array>
          </Set>
        </New>
      </Arg>
      <Set name="Port">[SSL Port Number]</Set>
      <Set name="maxIdleTime">120000</Set>
      <Set name="wantClientAuth">true</Set>
    </New>
  </Arg>
</Call>

Save the changes.
Verify that the SSL v3 protocol is disabled.
- The Cloud Manager secure URL (HTTPS) should be functional.
- There should be an entry in the log that shows that the SSLv3 protocol is not in the enabled protocol list. For example:
```
[12 Jan 2015 06:37:08] INFO  | g.ops4j.pax.web) | SslContextFactory   |  96 | Enabled Protocols [SSLv2Hello, TLSv1, TLSv1.1, TLSv1.2] of [SSLv2Hello, SSLv3, TLSv1, TLSv1.1, TLSv1.2]
```