Using Existing Certificates

<< Click to Display Table of Contents >>

Navigation:  Peer Global File Service Help > Advanced Topics > TLS Certificates >

Using Existing Certificates

Keytool Utility

Perform the necessary commands using the Keytool certificate management utility bundled with your Peer Management Center or Peer Agent installation.  The location of the utility is:

Peer Management Center system:  PMC_INSTALLATION_FOLDER\jre\bin

Peer Agent system:  PEER_AGENT_INSTALLATION_FOLDER\jre\bin

Peer Management Broker and Peer Agent Keystore Generation

You will need to have two custom/private certificates.  One for the Peer Management Broker and one for all the participating Peer Agents.  You may select different algorithms and encryption key size (i.e., RSA, DSA with 1024 or 2048 key size).

Step 1. Using the Keytool utility, list the contents of the custom/private certificates.  Perform these steps for both certificates (Peer Management Broker and Peer Agent.  Make a note of the Alias of the certificate, if it exists.

keytool -list -v -keystore HubCert.pfx -storetype pkcs12

 

HubCert.pfx

Represents the custom/private certificate for Peer Management Center Broker.

AgentCert.pfx

Represents the custom/private certificate for the Peer Agents.

Note: The command will prompt you to enter the password you set on your custom certificate, if applicable.

Step 2. Add the custom/private Peer Management Center Broker certificate into the Peer Management Center Broker keystore.

keytool -importkeystore -deststorepass plBroker4321 -destkeypass plBroker4321 -destkeystore broker.ks -srckeystore HubCert.pfx -srcstoretype PKCS12 -srcstorepass PASSWORD -alias ALIAS -destalias broker

 

plBroker4321

The password you assign to the new Broker keystore.

broker.ks

Destination keystore that will be created containing the custom/private certificate.

HubCert.pfx

Custom/private certificate being imported into the new keystore.

PASSWORD

The password of the custom/private certificate, if it exists.  If you omit the -srcstorepass command, you will be prompted for the certificate password if needed.

ALIAS

The Alias of the custom/private certificate you discovered in Step 1 above.

broker

The Alias of the new keystore containing the custom/private.

Note: The broker.cer and broker.ks files will be created in the \jre\bin folder where the keytool utility resides.

Step 3. Add the custom/private Peer Agent certificate into the Client keystore.

keytool -importkeystore -deststorepass plClient4321 -destkeypass plClient4321 -destkeystore client.ks -srckeystore AgentCert.pfx -srcstoretype PKCS12 -srcstorepass PASSWORD -alias ALIAS -destalias client

 

plClient4321

The password you assign to the new Broker keystore.

client.ks

Destination keystore that will be created containing the custom/private certificate.

AgentCert.pfx

Custom/private certificate being imported into the new keystore.

PASSWORD

The password of the custom/private certificate, if it exists.  If you omit the -srcstorepass command, you will be prompted for the certificate password if needed.

ALIAS

The Alias of the custom/private certificate you discovered in Step 1 above.

client

The Alias of the new keystore containing the custom/private.

Note: The client.cer and client.ks files will be created in the \jre\bin folder where the keytool utility resides.

Step 4. Export the broker's certificate so it can be shared with clients.

keytool -export -alias broker -keystore broker.ks -file broker.cer

 

broker

The Alias of the broker keystore containing the custom/private certificate created in Step 2 above.

broker.ks

The keystore file created in Step 2 above containing the custom/private certificate for the Broker.

broker.cer

The certificate file created in Step 2 above.

The command will prompt you to enter the password for the broker keystore (e.g. plBroker4321).

Step 5. Export the client's certificate so it can be shared with broker.

keytool -export -alias client -keystore client.ks -file client.cer

 

client

The Alias of the client keystore containing the custom/private certificate created in Step 3 above.

client.ks

The keystore file created in Step 3 above containing the custom/private certificate for the Peer Agents.

client.cer

The certificate file created in Step 3 above.

The command will prompt you to enter the password for the client keystore (e.g., plClient4321).

Step 6. Create a truststore for the broker and import the client's certificate.  This establishes that the broker "trusts" the client:

keytool -import -alias client -keystore broker.ts -file client.cer

 

client

The Alias of the client keystore containing the custom/private certificate created in Step 3 above.

broker.ts

The broker trust store to be created.

client.cer

The certificate file created in Step 3 above.

The command will prompt you to enter the password for the broker keystore (e.g., plBroker4321).

Step 7. Create a truststore for the client and import the broker's certificate.  This establishes that the client "trusts" the broker.

keytool -import -alias broker -keystore client.ts -file broker.cer

 

broker

The Alias of the client keystore containing the custom/private certificate created in Step 3 above.

client.ts

The client truststore to be created.

client.cer

The certificate file created in Step 2 above.

The command will prompt you to enter the password for the client keystore (e.g., plClient4321).

Copy the Generated Keystore Files into Their Appropriate Location

On the Peer Management Center system:

Copy the following files from the Peer Management Center_INSTALLATION_FOLDER\jre\bin directory into the Peer Management Center_INSTALLATION_FOLDER\Broker\keys directory on the Peer Management Center system.  Overwrite the existing files.

broker.ks

broker.ts

On the Peer Agent system:

Copy the following files from Peer Management Center_INSTALLATION_FOLDER\jre\bin directory into the PEER_AGENT_INSTALLATION_FOLDER\keys directory on the Peer Agent systems.  Overwrite the existing files.

client.ks

client.ts

Restart All Peer Management Center Services for the Changes to Take Effect

We recommend you create a folder outside the Peer Management Center/Peer Agent installation directories in which to store the keystore files. This will ensure that upgrades will not clear/overwrite these files. The steps outlining this process will be posted shortly.