Steps to create a new keystore for use in HSConnect LDAP process.

Summary:

The HSConnect Directory Services (HSCDS) process is a process created by Paul for managing access to the HSConnect application. This process provides interactions between the iTarget created LDAP and Pitt LDAP. When users request access to HSConnect the process determines whether or not a user is locally controlled or a Pitt AD user. In this process there are on-prem users and cloud based communications. Some applications such as DALR are using Amazon AWS Cloud services. The HSCDS was originally running on the old Liberty platform "Volcano". The service was migrated to ARK when we migrated to the Palo Alto firewalls and changed to internal private IP addresses. HSCDS now runs in the DMZ zone and we have specific firewall rules for AWS servers under the DLAR Clients NOG. In addition to the HSCDS we are running Matomo (webanalytics) on the server. The Matomo website is managing certificates through IIS web interface, but the HSCDS manages certificates via a Keystore file.

Previous configurations:

• The original, server was volcano and that server managed al certificates through a keystore because the liberty applications required it. below is what that keystore looked like:
  • 
• When the HSCDS migrated to ARK server the keystore looked like this:
• 
   
• Currently 20211206 the keystore looks like this:
• As you can see by the above keystores we used to use the entire chain in the keystore but we have found that this is not required. We assume at this point the only requirement was for the server certificate itself. We also believe that the entire chain was created depending upon the method used to create the keystore and request for a new certificate. In our current keystore we created a new keystore from scratch and then imported the key "key pair". When this years certificate expired we renewed it by using our normal method for requesting that focused on solving just the IIS website portion of the needs. It was not until the original/previous certificate expired that we realized the issue.

Creating a new Keystore and requesting new SSL certificate:

The reason we are using the keystore process to request for a certificate is that it will allow us to input the entire chain of the certificate when creating. Although this is not required for the HSCCDS to work it is preferred.

1. Logon to ARK or any system that has the keystore explorer application installed and working.
2. Open the application and select "Create a new keystore"
3.  You will be prompted with the type of keystore you want to create - choose jks
4. Now we need to "Generate Key Pair"
   1. Choose RSA
   2. Use 4096 key size
   3. 
       
5. We need to fill in the Generate Key Pair Certificate dialog box
   1. Use version 3
   2. Signature Algorithm is SHA-256with RSA
   3. We can only use 1 year certificates now.
   4. 
       
6. Click the icon to the right of the name field to display dialog box:
7. Fill in the appropriate information for the server/sites.
   1. Common Name (CN) the URL of the site e.g. myservername.hs.pitt.edu
   2. Organization Unit (OU): iTarget
   3. Organization Name (O): University of Pittsburgh
   4. Locality Name (L): Pittsburgh
   5. State Name(ST): Pennsylvania
   6. Country (C): US
   7. 
       
8. After clicking OK it will take you back to this window where we can now click Add Extensions if you need to add multiple names for Subject Alternative Names:
9. Click the Add Extensions button
10. Click the green plus to add an extension and select subject alternative name and check critical extension then click OK:
11. Now you can add the DNS names
12. Click the green plus to add each DNS name. Click the green plus and fill in the info. Make sure you select DNS Name. Once you are done click OK (in this case we want to add ark.hs.pitt.edu & webanalytics.hs.pitt.edu:
    1. First DNS name
    2. 
        
    3. second DNS name 
    4. 
        
13. Click OK once you see this window:
14. Click OK here as well:
15. Click OK
16. This should return you to the generate key pair certificate dialog box and you will be asked to provide the keypair Alias name. This may or may not be the first DNS entry you provided. If this is not showing the server name change it to use the server DNS name.
17. You will be prompted for the key pair password
18. You should now receive a message that the keypair was successful
19. You should also see your new keypair in the keystore. for example ark.hs.pitt.edu
    1. 
        
20. Right click on the new keypair generated and choose "Generate CSR"
    1. 
        
21. For the certificate Request use the below settings:
    1. PKCS #10
    2. SHA-256 with RSA
    3. Challenge field: leave blank
    4. Optional Company Name: leave blank
    5. Browse to E:\Certs enter filename with today's date for the certificate request.(csr).txt will be easier to open later. i.e. (myservername.hs.pitt.edu_YYYY_MM_DD.csr.txt). Select Choose.
    6. 
        
22. You should receive a Generate CSR successful message, click OK
23. Once the CSR has been created, the padlock icon in keystore will be open.
24. SAVE THE KEYSTORE
25. Saving the keystore prompts you for the keystore password. Use the normal password for our department
26. Now you are prompted for the keystore file name. This should identify the server for which this keystore will be used on. i.e. ark.hs.pitt.edu.jks. When working with Liberty applications or HSCDS teh file name would be "certificate.jks".
27. 
     
28. Now with our fully created keystore and key pair we can submit for a certificate from Pitt IT.
29. THIS IS WHERE I LEFET OFF.
30.  

Using the CSR file to request a SSL Certificate from Pitt.

1. You can now go to the Pitt website to request the Incommon Certificate.
2. Browse To:
   1. https://cert-manager.com/customer/InCommon/ssl?action=enroll
   2. Enter the access code: UPitt
   3. Enter email address svc-ssladmin@pitt.edu
   4. Click the "Check Access Code" button.
3. Select the Certificate type:
   1. For a single hostname, select the "InCommon SSL" option
   2. For more than one hostname, select the "InCommon Multi Domain SSL" option and enter all of the hostnames in the "Subject Alternative Names" field
4. Select your Certificate Profile: InCommon SSL (SHA-2) OLD=Choose Microsoft IIS 5.x and later
5. Certificate Term: Select 1 year
6. Paste the CSR, from the file you saved in E:\Certificates, into the textbox on the form
7. Click the "Get Common Name from CSR" button. Make sure it is correct
8. Select the certificate term 1 year
9. Enter and verify a pass-phrase for the certificate. Pass-phrase should be "itarget" all lower case, no quotes
10. External requester: svc-ssladmin@pitt.edu
11. Click the "Enroll" button.
12. You will now see a message indicating your request has been submitted successfully.
13. After CSSD has processed the request you will receive another email from which you can download the certificate. Download ALL the certs and save them in the E:\certs Directory.
14. Now we must add the appropriate certificates to the keystore we created.
15. Run As Administrator From the keytool GUI of the appropriate keystore, right click the new keypair and choose "Import CA Reply - From File". The cert reply file is " commonname_cert.cer"
16. Repeat the steps in 15 to add "commonname.cer" to add the rest of the cert chain.
    1. 
        
    2. 
        
17. Adding the " commonname.crt" adds the AAA certificate services level:
18. Save the keystore
19. Stop and restart the appropriate service on the server if necessary.
20. Open a web browser, go to the site and check that the site shows the new certificate expiration date

 NOTE - for Liberty back end servers after you create the JKS file you need to copy it to a specific directory.

1.  
   1. E:\IBM\WebSphere\Liberty\usr\shared\resources\certificates
   2. In this folder you will see two JKS files
      1. trust.jks
      2. servername.jks

6/24/2020Using INCommon SSL (SHA -2) type
the "hs_pitt_edu_cert.cer" is the cert file accepted in the keystore.
Available formats:
as Certificate (w/ chain), PEM encoded: https://cert-manager.com/customer/InCommon/ssl?action=download&sslId=1858452&format=x509 downloads as bidev01_hs_pitt_edu.cer
as Certificate only, PEM encoded: https://cert-manager.com/customer/InCommon/ssl?action=download&sslId=1858452&format=x509CO downloads as bidev01_hs_pitt_edu_cert.cer
as PKCS#7, PEM encoded: https://cert-manager.com/customer/InCommon/ssl?action=download&sslId=1858452&format=base64 downloads as bidev01_hs_pitt_edu.crt
as PKCS#7: https://cert-manager.com/customer/InCommon/ssl?action=download&sslId=1858452&format=bin
downloads as bidev01_hs_pitt_edu.p7b
Issuing CA certificates only:
as Root/Intermediate(s) only, PEM encoded: https://cert-manager.com/customer/InCommon/ssl?action=download&sslId=1858452&format=x509IO downloads as bidev01_hs_pitt_edu_interm.cer
as Intermediate(s)/Root only, PEM encoded: https://cert-manager.com/customer/InCommon/ssl?action=download&sslId=1858452&format=x509IOR downloads as bidev01_hs_pitt_edu_interm (1).cer