04.12.2012 Views

Windchill System Administrator's Guide

Windchill System Administrator's Guide

Windchill System Administrator's Guide

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Replication Security<br />

2. Restart the replica site MethodServer. Right after start-up, in the logs, you<br />

should see a line stating that replica has requested configuration from Master.<br />

Several lines below, there should be a response message specifying received<br />

configuration. Do a sanity check on the configuration.<br />

3. Restart the master site MethodServer. Right after start-up, in the logs, you<br />

should see a line stating that master site has attempted to refresh the<br />

configuration of the replica site. Check the replica site MethodServer.log to<br />

see that the configuration was actually received.<br />

To enable secure transactions, Content Replication requires replication sites to<br />

share a common, trusted certificate authority (CA). If a client experiences a java<br />

secure socket link exception (for example, "javax.net.ssl.SSLException: untrusted<br />

server cert chain"), the client needs to import the CA of the server to which it is<br />

making a request. See the section on Importing Certificates into Sites for more<br />

information.<br />

Importing Certificates into Sites<br />

Use the following commands to import certificates into master and replica sites:<br />

keytool -import -alias someAliasName -file<br />

path/to.certificateAuthority.cert<br />

-storetype jks -keystore /path/to/keystore.jks<br />

certificateAuthority.cert is the certificate of the certificate authority<br />

(CA), not the web server. In the case of a self-signed web certificate, the CA and<br />

the web server are the same.<br />

keystore.jks is the file that the trusted CA will be imported into. The Java<br />

secure socket extension (JSSE) provider has a truststore located at:<br />

$JAVA_HOME/jre/lib/security/jssecacerts<br />

The commands listed above install the CA to be trusted by all invocations of the<br />

given virtual machine. Alternatively, the CA can be imported into any file, and<br />

then referenced on the command line.<br />

The argument to java to use a trust store file is:<br />

-Djavax.net.ssl.truststore=fileName<br />

For example:<br />

keytool -import -alias Acme_CA -file /tmp/acme_ca.cert<br />

-storetype jks -keystore<br />

/home/jlk/wgm_for_proe/conf/cacerts.jks<br />

java -classpath /home/jlk/wgm_for_proe/lib/foo.jar:/...<br />

-<br />

Djavax.net.ssl.trustStore=/home/jlk/wgm_for_proe/conf/cacerts.j<br />

ks com.ptc.foo.jar<br />

4-16 <strong>Windchill</strong> <strong>System</strong> Administrator’s <strong>Guide</strong>

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!