Harmony eDelivery Access v1.1.0 Release Notes

Add support for upgrading Access Point using package manager. The Access Point can be upgraded using the following commands:

sudo apt update
sudo apt upgrade

The "harmony-ap" service is automatically stopped for the upgrade and automatically restarted after the upgrade if the service has been enabled. Otherwise, the service must be manually restarted after the upgrade.

Add support for upgrading SMP using package manager. The SMP can be upgraded using the following commands:

sudo apt update
sudo apt upgrade

The "harmony-smp" service is automatically stopped for the upgrade and automatically restarted after the upgrade if the service has been enabled. Otherwise, the service must be manually restarted after the upgrade.

Fix invalid log file path that caused an expection to be logged during the SMP startup.

Create and configure content truststore "/etc/harmony-smp/smp-trustore.jks" during fresh installation. The content truststore is not automatically created on version upgrade. It can be created manually by following the steps below.

1. Add the content truststore filename to the system configuration.

sudo mysql harmony_smp -e "INSERT INTO SMP_CONFIGURATION (PROPERTY, VALUE, CREATED_ON, LAST_UPDATED_ON) VALUES ('smp.truststore.filename', 'smp-truststore.jks', NOW(), NOW());"

2. Generate a password for the truststore.

TRUSTSTOREPASS=$(openssl rand -base64 12)

3. Create the truststore with a mock certificate.

sudo keytool -genkeypair -alias mock -keystore /etc/harmony-smp/smp-truststore.jks -storepass $TRUSTSTOREPASS -keypass $TRUSTSTOREPASS -dname "CN=mock" 2>/dev/null

4. Delete the mock certificate.

sudo keytool -delete -alias mock -keystore /etc/harmony-smp/smp-truststore.jks -storepass $TRUSTSTOREPASS 2>/dev/null

5. Add the truststore password to the system configuration.

sudo mysql harmony_smp -e  "INSERT INTO SMP_CONFIGURATION (PROPERTY, VALUE, CREATED_ON, LAST_UPDATED_ON) VALUES ('smp.truststore.password', '{DEC}{$TRUSTSTOREPASS}', NOW(), NOW()) ON DUPLICATE KEY UPDATE VALUE='{DEC}{$TRUSTSTOREPASS}', LAST_UPDATED_ON=NOW();"

6. Restart the "harmony-smp" service.

systemctl restart harmony-smp

Make the Access Point dynamic discovery client use the Access Point's TLS truststore instead of the system's default truststore. When Dynamic Discovery is used, the SMP's TLS certificate must be imported to the Access Point truststore. Before the change, the SMP's TLS certificate had to be imported to the system's default truststore.

The change is applied automatically to fresh installations only. In existing installations, the configuration change must be done manually.

• First, complete the version upgrade from version 1.0.0 to 1.1.0.
• Then, update the "/opt/harmony-ap/bin/setenv.sh" configuration file, and add "javax.net.ssl.trustStore" and "javax.net.ssl.trustStorePassword" properties to the configuration.
• Remember to update the "<tls_truststore_password>" placeholder with the password of the TLS truststore. The password can be found in the "/etc/harmony-ap/tomcat-conf/server.xml" file.
• Finally, restart the "harmony-ap" service.

#!/bin/sh

export JAVA_OPTS="$JAVA_OPTS -Djava.protocol.handler.pkgs=org.apache.catalina.webresources \
   -Ddomibus.config.location=/etc/harmony-ap -Ddomibus.work.location=/opt/harmony-ap/work \
   -Djavax.net.ssl.trustStore=/etc/harmony-ap/tls-truststore.jks -Djavax.net.ssl.trustStorePassword=<tls_truststore_password>"

Create and configure TLS truststore "/etc/harmony-smp/tls-trustore.jks" during fresh SMP installation. The TLS truststore is not automatically created on version upgrade. It can be created manually by following the steps below.

1. First, complete the version upgrade from version 1.0.0 to 1.1.0.

2. Generate a password for the truststore.

TLSTRUSTSTOREPASS=$(openssl rand -base64 12)

3. Export the SMP's own TLS certificate. Remember to update the "<tls_keytstore_password>" placeholder with the password of the TLS keystore. The password can be found in the "/etc/harmony-smp/tomcat-conf/server.xml" file.

sudo keytool -export -alias selfsigned -file /etc/harmony-smp/selfsigned.cer -keystore /etc/harmony-smp/tls-keystore.jks -storepass <tls_keystore_password> 2>/dev/null

4. Create the truststore with the exported certificate.

sudo keytool -import -noprompt -alias selfsigned -file /etc/harmony-smp/selfsigned.cer -keystore /etc/harmony-smp/tls-truststore.jks -storepass $TLSTRUSTSTOREPASS 2>/dev/null

5. Delete the exported certificate file.

rm -f /etc/harmony-smp/selfsigned.cer

6. Update the "/etc/harmony-smp/tomcat-conf/server.xml" configuration file and add the "truststoreFile" and "truststorePass" properties to the "Connector" element (lines 7 and 8). After the change, the element should look like this:

<Connector SSLEnabled="true"
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="8443" maxThreads="200"
           scheme="https" secure="true"
           keystoreFile="/etc/harmony-smp/tls-keystore.jks"
           keystorePass="{{tls_keystore_password}}"
           truststoreFile="/etc/harmony-smp/tls-truststore.jks"
           truststorePass="{{tls_truststore_password}}"
           clientAuth="false"
           sslProtocol="TLS" />

7. Update the "/opt/harmony-smp/bin/setenv.sh" configuration file, and add "javax.net.ssl.trustStore" and "javax.net.ssl.trustStorePassword" properties to the configuration. After the change, the configuration file should look like this:

#!/bin/sh

export CLASSPATH=/etc/harmony-smp

export JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStore=/etc/harmony-smp/tls-truststore.jks \
   -Djavax.net.ssl.trustStorePassword={{tls_truststore_password}}"

8. Restart the "harmony-smp" service.

systemctl restart harmony-smp