17.1 Sending Events in FIPS Mode

Secure Configuration Manager can send events to Sentinel when either or both of the applications are in FIPS mode. For more information about FIPS Mode, see Enabling FIPS Communication.

17.1.1 Sentinel is in FIPS Mode

For information about FIPS mode configuration in Sentinel, see the Sentinel Documentation.

Secure Configuration ManagerSecure Configuration ManagerBy default, Sentinel uses a NSS provider when FIPS mode is enabled. To connect to the server, you need to add the server certificate to Sentinel's NSS truststore.

Secure Configuration ManagerUse keytool to export the certificate to Sentinel NSS truststore from vssl.keystore. Keytool is located by default in the C:\Program Files (x86)\NetIQ\Secure Configuration Manager\Core Services\jre\bin folder.

  1. Secure Configuration ManagerTo export the certificate, enter the following command:

    keytool.exe -export -keystore ..\..\etc\vssl.keystore -alias alias_of_keystore_server -file certificate_name.cer

    For example:

    keytool.exe -export -keystore ..\..\etc\vssl.keystore -alias vsskey  -file myserver.cer

  2. On the Sentinel server, copy the certificate file to the tmp folder.

  3. To import the certificate, run the following command:

    /usr/bin/certutil -A -d /etc/opt/novell/sentinel/3rdparty/nss -t "CT,CT,CT" -n "name_of_Secure_Configuration_Manager_server" -i /tmp/certificate_name.cer

  4. When prompted, enter the password for the server.

  5. Restart the Sentinel server.

17.1.2 Secure Configuration Manager is in FIPS Mode

Secure Configuration ManagerSecure Configuration ManagerWhen is in FIPS mode, it uses a NSS provider. You need to import the Sentinel certificate to the NSS database.

  1. To export the Sentinel web server certificate, enter the following command:

    /opt/novell/sentinel/jre/bin/keytool -export -keystore .webserverkeystore.jks -alias webserver -file 200.cer

  2. Secure Configuration ManagerTo import the certificate to the server, enter the following command:

    certutil.exe -A -d c:\SCMNSS\etc -i "c:\200.cer" -n webserver  -t "CT,CT,CT"

  3. Restart NetIQ Core Services.

17.1.3 Secure Configuration ManagerBoth and Sentinel are in FIPS Mode

Secure Configuration ManagerIf Sentinel and are both in FIPS mode, each uses a NSS provider. You need to add each application’s certificate to the other application’s NSS Keystore.

Use keytool to export the certificates. Keytool is located by default in the C:\Program Files (x86)\NetIQ\Secure Configuration Manager\Core Services\jre\bin folder.

Add the Certificate to Sentinel

  1. Secure Configuration ManagerLog in to the server.

  2. To export the certificate from the NSS store, enter the following command:

    c:\Program Files\NetIQ\Secure Configuration Manager\Core Services\jre\bin>keytool.exe -export -keystore ..\..\etc\vssl.keystore -alias vsskey -file alias_of_keystore_server.cer

    For example:

    c:\Program Files\NetIQ\Secure Configuration Manager\Core Services\jre\bin>keytool.exe -export -keystore ..\..\etc\vssl.keystore -alias vsskey -file myserver.cer

  3. Enter the password or PIN for the NSS FIPS certificate database.

    You can also specify the credentials in the nss/keystore/password field in the Advanced tab of the Core Services Configuration Utility.

  4. On the Sentinel server, copy the certificate file to the tmp folder.

  5. To import the certificate, run the following command:

    /usr/bin/certutil -A -d /etc/opt/novell/sentinel/3rdparty/nss -t "CT,CT,CT" -n "alias_of_Secure_Configuration_Manager_server" -i /tmp/certificate_name.cer

    For example:

    /usr/bin/certutil -A -d /etc/opt/novell/sentinel/3rdparty/nss -t "CT,CT,CT" -n "vsskey" -i /tmp/SCMserver.cer

  6. To set the trust flags on Sentinel, enter the following command:

    certutil -M -n server_name -t "CT,C,C" -d /etc/opt/novell/sentinel/3rdparty/nss/

  7. Restart the Sentinel server.

Secure Configuration ManagerAdd the Certificate to

  1. Log in to the Sentinel server.

  2. To export the certificate from the NSS store, enter the following command:

    ./keytool -export -keystore .webserverkeystore.jks -alias webserver -file webserver.cer

  3. Secure Configuration ManagerOn the , import the certificate with the following command:

    c:\Program Files\NetIQ\Secure Configuration Manager\Core Services\bin>certutil.exe -A -d c:\SCMNSS\etc -i "webserver.cer" -n webserver -t "CT,CT,CT"

  4. To set the certificate flag, enter the following command:

    certutil -M -n webserver -t "CT,CT,CT" -d c:\SCMNSS\etc

  5. Restart NetIQ Core Services.