Here is a quick guide for enabling SSL on Tomcat with the SCOM 2012 Java Management Pack (download here). As this Java APM Management Pack (download here) extends the previous MP, this content applies here too.
Step #1: Generate Key
If you already have a certificate great (also why are you reading this guide)! Otherwise, you need to generate a key for the Tomcat server to have. Once we tell Tomcat that it needs to use this key, then we’ll need to make SCOM aware that said key identifies the application server.
The JAVA SDK contains a keytool. This command-line tool is a means of generating a certificate. Look around online for some tips on using the tool (for example).
Sample output of running the tool might look similar to this:
Prompt>: %JAVA_HOME%\bin\keytool -genkey -alias tomcat -keyalg RSA -validity 1000
Enter keystore password changeit
Re enter the password changeit
What is your first and last name? This value should be the FQDN of the application server. omx-xxx-xx.contoso.com
What is the name of your organizational unit? Enter some value
What is the name of your organization? Enter some value
What is the name of your City or Locality? Enter some value
What is the name of your State or Province? Enter some value
What is the two-letter country code for this unit? Enter some value
Select Y to confirm the choices
Enter key password for <tomcat> This must be the same as the keystore key (Tomcat oddity - changeit)
Re-enter new password:
Once complete, the output file (.keystore) is placed in “Users\<userid>” folder. Move this to an appropriate location
Step #2: Setup Tomcat
For versions 6.0 and prior, in the Tomcat conf directory edit the server.xml file.
Note: for Tomcat 7 you need to configure the protocol depending on the SSL provider you would like to use. If you want to use the JSSE SSL provider you should set the protocol to “org.apache.coyote.http11.Http11Protocol“.
Now, let’s do a quick sanity check. Start Tomcat and try to access BeanSpy via HTTPS. As we have not completed the setup yet, there should be a certificate security error if you access https://omx-xxx-xx.contoso.com:8443/BeanSpy/Stats. Continue through the error and you should see the Stats page.
Step #3: Export Certificate from KeyStore
The final step is that now we need to export the certificate from the Keystore and make it available to the Windows machine that will connect to the Agent. If the Tomcat instance is running on a Windows machine, you should import the certificate to that Windows machine. If the Tomcat instance is running on Linux or will be Universally discovered, the certificate should be imported to the Management Server machine(s) (i.e. each machine in the management pool).
First, let’s export the certificate:
Prompt> %JAVA_HOME%\bin\keytool -export -keystore C:\Users\SCXSVC\.keystore -file Tomcat.cer -alias tomcat
Next, we need to import the certificate into the NTAuth store.
- Start Microsoft Management Console (Mmc.exe),
- We need to add the PKI Health snap-in. In the File menu, click Add/Remove Snap-in.
- In the list of snap-ins, click Certificates.
- Click Add.
- Select “Local Computer” then click Finish.
- Click OK.
- On the “Trusted Root Certification Authorities” context menu select “All tasks” and “Import”.
- Select Next.
- Browse for the certificate file and select Next.
- Select “Place all certificates in the following store” and select the “Trusted Root Certification Authorities” store.
- Click Next.
- Click Finish.
Finally, let’s re-run the check from Step #2 and verify there is no longer a certificate error.