Implement model authentication and encryption - Connect_CDC - aws_mainframe_modernization_service - connect_cdc_mimix_share - Latest

A utility file named configuretls.cmd is provided in kernel folder of the connect cdc installation to facilitate the creation of the self-signed certificate and configure connect to run in secured mode. An example of running this utility and its output is shown below.

C:\PreciselyConnect\ConnectCDCV58>kernel\configuretls.cmd
Creating certificate file C:\Users\Administrator\.cdc\certs\connect-cdc-keystore.p12...
Exporting certificate C:\Users\Administrator\.cdc\certs\connect-cdc.crt from Keystore file: C:\Users\Administrator\.cdc\certs\connect-cdc-keystore.p12
Importing certificate C:\Users\Administrator\.cdc\certs\connect-cdc.crt into Trustore file: C:\Users\Administrator\.cdc\certs\connect-cdc-trustore.p12 with alias connect-cdc
Certificate generation complete.
Enabling TLS configuration...
Updating file: C:\PreciselyConnect\ConnectCDCV58\kernel/wrapper.conf
Updating file: C:\PreciselyConnect\ConnectCDCV58\director/omnient.ini
Updating file: C:\PreciselyConnect\ConnectCDCV58\kernel/startmoncon.cmd
Updating file: C:\PreciselyConnect\ConnectCDCV58\kernel/startconsole.cmd
Updating file: C:\PreciselyConnect\ConnectCDCV58\kernel/startlistener.cmd

To manually configure TLS for connect cdc:

1. Use keytool to generate a self-signed certificate. For example,

   keytool -genkeypair -alias connect-agent -keyalg RSA -keysize ${KEY_SIZE} -storetype ${STORE_TYPE} -keystore ${KEYSTORE_FILE} -validity <num_days> -storepass "${TRUSTSTORE_PASSWORD}" 
   ${KEYPWD_OPTION} -dname "CN=CommonName, OU=OrganizationalUnit, O=Organization, L=Locality,ST=StateOrProvinceName,C=CountryName"

2. Export the certificate. For example,

   keytool -export -alias connect-cdc -file connect-cdc.crt -keystore ${KEYSTORE_FILE} -storepass 
   "${TRUSTSTORE_PASSWORD}" -storetype ${STORE_TYPE}

3. Import the certificate to a truststore to trust it. For example,

   keytool -import -alias connect-cdc-trust -file connect-cdc.crt -keystore ${TRUSTORE_FILE} -storepass 
   "${TRUSTSTORE_PASSWORD}" ${KEYPWD_OPTION} -storetype ${STORE_TYPE} -noprompt

   Note: The keystore and truststore files can be same or different files.
4. Configure kernel/wrapper.conf file and add these properties:

   wrapper.java.additional.4=-Dwrapper-debug=false 
   wrapper.java.additional.5=-Dconfiguration.file=../conf/cdc_connect.properties

5. Adjust director/omnient.ini and add this property:

   SelfSignedCertificate=C:\Users\Administrator\.cdc\certs\cert.json

6. Adjust the following files and add:

   kernel/startmoncon.cmd
   kernel/startconsole.cmd
   kernel/startlistener.cmd

   Add these properties:

   -Dconnect.cdc.tls.config_file="C:\Users\Administrator\.cdc\certs\cert.json" -Dssle

7. Create certs.json file with the following content:

   {
     "connectTLS": {
       "certificateInfo": {
           "keyStoreType": "PKCS12",
           "keyStorePassword": "g/+sbUmgwitP7EOa",
           "keyCertificateAlias": "connect-cdc",
           "keyStoreFile": "C:/Users/gfostine/.cdc/certs/connect-cdc-keystore.p12",
           "trustStoreType": "PKCS12",
           "trustStorePassword": "858jnCbq5b1v8BPE",
           "trustStoreFile": "C:/Users/gfostine/.cdc/certs/connect-cdc-trustore.p12"
       }
     }
   	}