3.4 Generating Certificates With Identity Vault Certificate Authority

(Conditional) This section applies only if you are using Identity Vault as the Certificate Authority.

The following components require you to generate certificates before they are deployed. Before you generate the certificates for the following components, ensure that you deploy the Identity Manager Engine and iManager containers.

NOTE:The iManager container can be deployed as a standalone container using Docker. For more information, see Deploying iManager Container in the NetIQ Identity Manager: Deploying Identity Manager 4.8.1 Containers.

3.4.1 Generating Certificates for OSP

Perform the following steps to generate the certificates:

  1. Log in to the iManager container.

    docker exec -it <container name> bash

    For example,

    docker exec -it imanager bash

  2. Ensure that you set the Java path. For example, run the following command:

    export PATH=<java installed location>/bin:$PATH

    For example,

    export PATH=/opt/netiq/common/jre/bin/:$PATH

    NOTE:Ensure that the Java version installed is Azul Zulu 1.80_252 or later.

  3. Generate the PKCS keystore:

    keytool -genkey -alias osp -keyalg RSA -storetype pkcs12 -keystore /config/tomcat-osp.ks -validity 3650 -keysize 2048 -dname "CN=osp.example.com" -keypass <password> -storepass <password>

  4. Generate a certificate signing request:

    keytool -certreq -v -alias osp -file /config/osp.csr -keypass <password> -keystore /config/tomcat-osp.ks -storepass <password>

  5. Generate a self-signed certificate:

    1. Launch iManager from Kubernetes worker node and log in as an administrator.

    2. Navigate to Roles and Tasks > NetIQ Certificate Server > Issue Certificate.

    3. Browse to the .csr file created in step 4. For example, osp.csr.

    4. Click Next.

    5. Specify the key usage and click Next.

    6. For the certificate type, select Unspecified.

    7. Click Next.

    8. Specify the validity of the certificate and click Next.

    9. Select the File in binary DER format radio button.

    10. Click Next.

    11. Click Finish.

    12. Download the certificate and copy the downloaded certificate to the /data directory.

  6. Export the root certificate in .der format:

    1. Launch iManager from Kubernetes worker node and log in as an administrator.

    2. Navigate to Roles and Tasks > NetIQ Certificate Access > Server Certificates.

    3. Select the SSL CertificateDNS check box and click Export.

    4. In the Certificates drop-down list, select the Organizational CA.

    5. In the Export Format drop-down list, select DER.

    6. Click Next.

    7. Download the certificate and copy the downloaded certificate to the /data directory.

  7. Import the certificates into the PKCS keystore you created in step 2:

    keytool -import -trustcacerts -alias root -keystore /config/tomcat-osp.ks -file /config/cert.der -storepass <password> -noprompt

    keytool -import -alias osp -keystore /config/tomcat-osp.ks -file /config/osp.der -storepass <password> -noprompt

NOTE:Ensure that the keystore is available in the path that was specified as an input for deployment.

3.4.2 Generating Certificates for Identity Applications

Perform the following steps to generate the certificates:

  1. Log in to the iManager container.

    docker exec -it <pod name> bash

    For example,

    docker exec -it imanager bash

  2. Ensure that you set the Java path. For example, run the following command:

    export PATH=<java installed location>/bin:$PATH

    For example,

    export PATH=/opt/netiq/common/jre/bin/:$PATH

    NOTE:Ensure that the Java version installed is Azul Zulu 1.80_252 or later.

  3. Generate the PKCS keystore:

    keytool -genkey -alias ua -keyalg RSA -storetype pkcs12 -keystore /config/tomcat-ua.ks -validity 3650 -keysize 2048 -dname "CN=identityapps.example.com" -keypass <password> -storepass <password>

  4. Generate a certificate signing request:

    keytool -certreq -v -alias ua -file /config/ua.csr -keypass <password> -keystore /config/tomcat-ua.ks -storepass <password>

  5. Generate a self-signed certificate:

    1. Log in to iManager as an administrator.

    2. Navigate to Roles and Tasks > NetIQ Certificate Server > Issue Certificate.

    3. Browse to the .csr file created in step 4. For example, ua.csr.

    4. Click Next.

    5. Specify the key usage and click Next.

    6. For the certificate type, select Unspecified.

    7. Click Next.

    8. Specify the validity of the certificate and click Next.

    9. Select the File in binary DER format radio button.

    10. Click Next.

    11. Click Finish.

    12. Download the certificate and copy the downloaded certificate to the /data directory.

  6. Export the root certificate in .der format:

    1. Log in to iManager as an administrator.

    2. Navigate to Roles and Tasks > NetIQ Certificate Access > Server Certificates.

    3. Select the SSL CertificateDNS check box and click Export.

    4. In the Certificates drop-down list, select the Organizational CA.

    5. In the Export Format drop-down list, select DER.

    6. Click Next.

    7. Download the certificate and copy the downloaded certificate to the /data directory.

  7. Import the certificates into the PKCS keystore in step 2:

    keytool -import -trustcacerts -alias root -keystore /config/tomcat-ua.ks -file /config/cert.der -storepass <password> -noprompt

    keytool -import -alias ua -keystore /config/tomcat-ua.ks -file /config/ua.der -storepass <password> -noprompt

NOTE:Ensure that the certificates are available in the path that was specified as an input for deployment.

3.4.3 Generating Certificates for Identity Reporting

Perform the following steps to generate the certificates:

  1. Log in to the iManager container.

    docker exec -it <pod name> bash

    For example,

    docker exec -it imanager bash

  2. Ensure that you set the Java path. For example, run the following command:

    export PATH=<java installed location>/bin:$PATH

    For example,

    export PATH=/opt/netiq/common/jre/bin/:$PATH

    NOTE:Ensure that the Java version installed is Azul Zulu 1.80_252 or later.

  3. Generate the PKCS keystore:

    keytool -genkey -alias rpt -keyalg RSA -storetype pkcs12 -keystore /config/tomcat-rpt.ks -validity 3650 -keysize 2048 -dname "CN=identityreporting.example.com" -keypass <password> -storepass <password>

  4. Generate a certificate signing request:

    keytool -certreq -v -alias rpt -file /config/rpt.csr -keypass <password> -keystore /config/tomcat-rpt.ks -storepass <password>

  5. Generate a self-signed certificate:

    1. Log in to iManager as an administrator.

    2. Navigate to Roles and Tasks > NetIQ Certificate Server > Issue Certificate.

    3. Browse to the .csr file created in step 4. For example, rpt.csr.

    4. Click Next.

    5. Specify the key usage and click Next.

    6. For the certificate type, select Unspecified.

    7. Click Next.

    8. Specify the validity of the certificate and click Next.

    9. Select the File in binary DER format radio button.

    10. Click Next.

    11. Click Finish.

    12. Download the certificate and copy the downloaded certificate to the /data directory.

  6. Export the root certificate in .der format:

    1. Log in to iManager as an administrator.

    2. Navigate to Roles and Tasks > NetIQ Certificate Access > Server Certificates.

    3. Select the SSL CertificateDNS check box and click Export.

    4. In the Certificates drop-down list, select the Organizational CA.

    5. In the Export Format drop-down list, select DER.

    6. Click Next.

    7. Download the certificate and copy the downloaded certificate to the /data directory.

  7. Import the certificates into the PKCS keystore you created in step 2:

    keytool -import -trustcacerts -alias root -keystore /config/tomcat-rpt.ks -file /config/cert.der -storepass <password> -noprompt

    keytool -import -alias rpt -keystore /config/tomcat-rpt.ks -file /config/rpt.der -storepass <password> -noprompt

NOTE:Ensure that the certificates are available in the path that was specified as an input for deployment.