How to Change SMP Sign Certificate?
- Petteri Kivimäki
Analytics
By default, the SMP has a self-signed sign certificate that's automatically generated during the SMP installation process. Changing the certificate and/or recreating the private key is not possible through the SMP UI. Instead, both operations require shell access to the SMP.
Step-by-step guide
The SMP sign certificate can be changed by following the steps described below.
First, take backup copy of the content encryption keystore file:
cp -a /etc/harmony-smp/smp-keystore.jks /etc/harmony-smp/smp-keystore.jks.bak
Generate a new private key and certificate signing request (CSR) by running the command:
openssl req -x509 -newkey rsa:3072 -keyout harmony-smp-new.key -out harmony-smp-new.crt -days 365 -nodes
- Enter your CSR details.
Locate and open the newly created CSR ("/etc/harmony-smp/harmony-smp-new.crt") in a text editor and copy all the text including:
/etc/harmony-smp/harmony-smp-new.crt-----BEGIN CERTIFICATE REQUEST----- And -----END CERTIFICATE REQUEST-----
- Paste the contents of the CSR file in a local text file on your workstation.
- Purchase certficate from a trusted Certificate Authority (CA) using the CSR file.
- Once the CA has issued the certificate, rename the certificate file to "harmony-smp-new.crt", and copy it to "/etc/harmony-smp/" directory on the SMP.
Create a PKCS#12 container ("/etc/harmony-smp/harmony-smp.p12") that includes the new key and certificate, and the certificate chain. Write down the container password ("<container_password>"). Replace the "<cert_alias>" placeholder with your preferred alias.
openssl pkcs12 -export -in harmony-smp-new.crt -inkey harmony-smp-new.key -out harmony-smp.p12 -name <cert_alias> -CAfile ca_bundle.crt -caname cacert
Check the password of the content encryption keystore file from the MySQL database table "
SMP_CONFIGURATION" with key "smp.keystore.password". The format is "{DEC}{$PASSWORD}"where "$PASSWORD"is the keystore password.sudo mysql -e "use harmony_smp; select * from SMP_CONFIGURATION where PROPERTY = 'smp.keystore.password';"
Import the PKCS#12 container into the SMP content encryption keystore.
keytool -importkeystore -deststorepass <smp_keystore_password> -destkeypass <smp_keystore_password> -destkeystore /etc/harmony-smp/smp-keystore.jks -srckeystore /etc/harmony-smp/harmony-smp.p12 -srcstoretype PKCS12 -srcstorepass <container_password> -alias <cert_alias>
Update the file permissions.
chown -R harmony-smp:harmony-smp /etc/harmony-smp chmod -R 0751 /etc/harmony-smp
Restart the "harmony-smp" service.
systemctl restart harmony-smp
- Check that the log file ("/var/log/harmony-smp/catalina.out") doesn't contain any TLS related errors.
- In case something goes wrong, restore the original files, and restart the "harmony-smp" service.
Related articles