How to Change SMP Sign Certificate?

Owned by Petteri Kivimäki
Feb 28, 2022

By default, the SMP has a self-signed sign certificate that's automatically generated during the SMP installation process. Changing the certificate and/or recreating the private key is not possible through the SMP UI. Instead, both operations require shell access to the SMP.

Step-by-step guide

The SMP sign certificate can be changed by following the steps described below.

  1. First, take backup copy of the content encryption keystore file:

    cp -a /etc/harmony-smp/smp-keystore.jks /etc/harmony-smp/smp-keystore.jks.bak

  2. Generate a new private key and certificate signing request (CSR) by running the command:

    openssl req -x509 -newkey rsa:3072 -keyout harmony-smp-new.key -out harmony-smp-new.crt -days 365 -nodes
  3. Enter your CSR details.

  4. Locate and open the newly created CSR ("/etc/harmony-smp/harmony-smp-new.crt") in a text editor and copy all the text including:

    /etc/harmony-smp/harmony-smp-new.crt
    -----BEGIN CERTIFICATE REQUEST-----
And
-----END CERTIFICATE REQUEST-----
  5. Paste the contents of the CSR file in a local text file on your workstation.
  6. Purchase certficate from a trusted Certificate Authority (CA) using the CSR file.
  7. Once the CA has issued the certificate, rename the certificate file to "harmony-smp-new.crt", and copy it to "/etc/harmony-smp/" directory on the SMP.

  8. Create a PKCS#12 container ("/etc/harmony-smp/harmony-smp.p12") that includes the new key and certificate, and the certificate chain. Write down the container password ("<container_password>"). Replace the "<cert_alias>" placeholder with your preferred alias.

    openssl pkcs12 -export -in harmony-smp-new.crt -inkey harmony-smp-new.key -out harmony-smp.p12 -name <cert_alias> -CAfile ca_bundle.crt -caname cacert

  9. Check the password of the content encryption keystore file from the MySQL database table "SMP_CONFIGURATION" with key "smp.keystore.password". The format is "{DEC}{$PASSWORD}" where "$PASSWORD" is the keystore password.

    sudo mysql -e "use harmony_smp; select * from SMP_CONFIGURATION where PROPERTY = 'smp.keystore.password';"

  10. Import the PKCS#12 container into the SMP content encryption keystore.

    keytool -importkeystore -deststorepass <smp_keystore_password> -destkeypass <smp_keystore_password> -destkeystore /etc/harmony-smp/smp-keystore.jks -srckeystore /etc/harmony-smp/harmony-smp.p12 -srcstoretype PKCS12 -srcstorepass <container_password> -alias <cert_alias>

  11. Update the file permissions.

    chown -R harmony-smp:harmony-smp /etc/harmony-smp
chmod -R 0751 /etc/harmony-smp

  12. Restart the "harmony-smp" service.

    systemctl restart harmony-smp
  13. Check that the log file ("/var/log/harmony-smp/catalina.out") doesn't contain any TLS related errors.
  14. In case something goes wrong, restore the original files, and restart the "harmony-smp" service.