23.1 Enabling Mutual SSL Communication and Certificate Revocation List

To enable the mutual SSL communication and CRL in the Sentinel server:

1. Go to the <sentinel_installation_path>/opt/novell/sentinel/bin directory.

2. Run the following command as novell user:

    ./createDefaultMutualCert.sh 

3. Specify the password for the certificate to be generated.

   A certificate with name .defaultRestClient.p12 will be generated in the <sentinel_installation_path>/etc/opt/novell/sentinel/config directory.

4. To add the CRL file, complete one of the following steps:

   1. If the CRL file is available:

      1. Copy the CRL file <crl_file_name> to the following location in the Sentinel server:<sentinel_installation_path>/etc/opt/novell/sentinel/config.

      2. In the <sentinel_installation_path>/etc/opt/novell/sentinel/config/configuration.properties file, make the following changes:

         sentinel.webserver.crlfile=/config/<crl_file_name>

      3. In the <sentinel_installation_path>/etc/opt/novell/sentinel/3rdparty/jetty/jetty-ssl-context.xml file, replace /config/pulp_crl.pem with /config/<crl_file_name>.

   2. If the CRL file is not available:

      1. Go to <sentinel_installation_path>/etc/opt/novell/sentinel/config/.

      2. Run the following command:

          touch pulp_crl.pem

5. (Conditional) If the Sentinel server is in the FIPS mode, then complete the following steps:

   1. Go to <sentinel_installation_path>/opt/novell/sentinel/bin/.

   2. Run the following command:

      ./convert_to_fips -i <sentinel_installation_path>
      /etc/opt/novell/sentinel/config/
      .defaultRestClient.p12

6. Restart the Sentinel server.

7. Go to <sentinel_installation_path>/opt/novell/sentinel/setup directory in Collector Manager and Correlation Engine.

8. Run the following command and follow on-screen instructions to make Collector Manager and Correlation Engine compatible with the Sentinel server:

   ./configure.sh