Installing Digital Certificates

To install the CA server certificate:

1. Generate the RSA private key for the certificate authority.

2. Generate the Certificate Signing Request (CSR) for the certificate authority.

3. Generate the PEM file.

   Note: If a CA certificate already exists in PEM format, the preceding three steps can be omitted.

4. Import the CA Certificate in PEM format using PeopleTools > Security > Security Objects > Digital Certificates.

The preceding steps are explained in detail in the section Configuring Digital Certificates.

See Configuring Digital Certificates, Implementing Client Authentication.

To install the REN server certificate:

1. Generate REN server CSR using PeopleTools > Security > Security Objects > Digital Certificates.

2. Get the CSR signed by a CA.

   Note: The certificate must be in PEM format.

3. Import the certificate into PeopleTools > Security > Security Objects > Digital Certificates.

The preceding steps are explained in detail in the section Configuring Digital Certificates.

See Configuring Digital Certificates.

Before configuring digital certificates, you must generate the private keys, CSR, and PEM file.

To configure digital certificates:

1. Select PeopleTools > Security > Security Objects > Digital Certificates.

2. Click +.

3. Select ROOTCA from the Type drop-down list box.

4. Enter an alias name for the CA in Alias, and click Add Root.

   The Add Root Certificate dialog box appears.

5. Open the ca.pem file.

   The root CA certificate is generated.

6. Copy the contents of the ca.pem file, paste them into the Add Root Certificate dialog box, and click OK.

7. Click +.

8. Select Cert from the Type drop-down list box.

9. Enter an alias name in Alias, such as PSFTCA.

10. Click Add Root.

11. Select the CA certificate alias of step 4 from the Issuer Alias lookup button.

12. Click Request.

    The Request New Certificate dialog box appears.

13. Complete the Common Name, Org Unit (organization unit), Organization, Locality, State/Province, Country, Algorithm, Key Size, Email Address, and Challenge Pswdfields.

    Note: The common name must be the machine name of the REN server machine, for example, PTA112.peoplesoft.com, where PTA112 is the machine name and .peoplesoft.com is the domain name.

14. Click OK.

    The Certificates Signing Request dialog box appears.

15. Copy and paste the text from the Certificates Signing Request dialog box, and save the text in a file named ren.csr in <PS_HOME>\appserv\<domain name>\.

16. Click OK.

    The Import link appears.

17. Submit ren.csr to the CA that issued the selected root certificate.

    The CA may send you the signed public key certificate by email or require you to download it from a specified web page.

18. Open the saved certificate file in a text editor, and then highlight and copy its entire contents.

19. Select PeopleTools > Security > Security Objects > Digital Certificates.

20. Click Import.

    The Import Certificate page appears.

21. Paste the copied certificate content into the long edit box, and click OK.

See Implementing Node Authentication, Implementing Nonrepudiation.

In order for REN Java clients, such as a queue server, MCF Log server, or CTI adapter, to communicate with an SSL-enabled REN server, these clients need to have SSL certificates available in a Java keystore. You must import the REN server certificates into the keystore used by each REN Java client. For the Queue servers and MCF Log servers, this will be the keystore used by the JRE in the PeopleSoft domain where the queue server and MCF Log server are running.  For CTI adapters, this will be the JRE used by the adapter.

The following example shows how to install the REN server certificates into the JRE trust store for a queue server and MCF log server. You will need to repeat this procedure for every queue server domain being used.  You will also need to perform a similar procedure for CTI adapters or any other REN Java client, if you are using them. 

To import certificates in Java keystore:

1. Open a command prompt.

2. Enter the following command:

   <PS_HOME>\jre\bin\keytool -import -trustcacerts -alias <alias-name> 
   -file <CA Certificate Pem file> -keystore <full path to keystore used by the REN Java client> 
   -storepass <password>

   Example:

   <PS_HOME>\jre\bin\keytool -import -trustcacerts -alias PSFTCA -file ca.pem 
   -keystore <PS_HOME>\jre\lib\security\cacerts -storepass changeit

See Implementing Client Authentication.

To configure the REN server for SSL:

1. Select PeopleTools > REN Server Configuration > REN Server Definition.

   The REN Server Definition page appears.

2. Select the SSL Only check box.

3. Select your REN Server certificate from the Certificate Alias drop-down list box.

4. Click Save.

To configure REN clusters:

1. Select PeopleTools > REN Server Configuration > REN Server Cluster.

   The REN Server Cluster page appears.

2. Update the REN server cluster URL using https and the SSL port.

3. Update the REN server browser URL using https and the SSL port.

4. Click Save.

Apart from the CA and REN server certificates, client authentication requires local node certificates, a client certificate for the browser, and a PSMCAPI certificate.

To install certificates for the local node:

1. Select PeopleTools > Security > Security Objects > Digital Certificates.

2. Click +.

3. Select Local Node from the Type drop-down list box.

4. Enter the local node name in Alias, and click Add Root.

5. Select the alias of the CA certificate from the Issuer Alias lookup button.

6. Click Request.

7. Complete the Common Name, Org Unit, Organization, Locality, State/Province, Country, Algorithm, Key Size, Email Address, and Challenge Pswd fields.

   Note: The common name must be the machine name of the REN server machine, for example, PTA112.peoplesoft.com, where PTA112 is the machine name and .peoplesoft.com is the domain name.

8. Click OK.

   The Certificates Signing Request dialog box appears.

9. Copy and paste the text from the Certificates Signing Request dialog box, and save the text in a file.

10. Click OK.

    The Import link appears.

11. To obtain your local node certificate, submit the certificate request text to the CA that issued the selected root certificate.

    The process of obtaining digital certificates varies, depending on the CA. Typically, a CA requires you to paste the content of the PEM-formatted CSR into a form that you submit online. The CA may send you the signed public key certificate by email or require you to download it from a specified web page.

12. Open the saved certificate file in a text editor, and then highlight and copy its entire contents.

13. Select PeopleTools > Security > Security Objects > Digital Certificates.

14. Click the Import link.

    The Import Certificate page appears.

15. Paste the copied certificate content into the long edit box, and click OK.

See Implementing Node Authentication, Implementing Nonrepudiation.

You can generate the client certificate by openssl or keytool in P12 format and import it in the browser. Importing the certificates depends on the browser.

The following steps are an example of generating a client certificate using openssl. Clients can use keytool or Microsoft CA to generate the client certificate.

To generate the client certificate using openssl:

1. Generate the RSA private key.

   openssl genrsa -des3 -out <Private key file>

   Example:

   openssl genrsa des3 out renclient.key passout pass:pass 1024

2. Generate a CSR file.

   openssl req -config <filename> -new -M;key <Private key file> -out <CSR file>

   Example:

   openssl req -config ..\apps\openssl.cnf -new -key renclient.key -x509 -days 365 -out renclient.csr

3. Generate a PEM format file.

   openssl x509 -req -days 365 in <CSR file> -CA <CA PEM File> -CAkey<CA 
   Key File> CAcreateserial -out <RenServer PEM file> -outform PEM

   Note: <CA key file> and <CA PEM file> are Certificate Authority Key file and Certificate Authority in PEM format respectively.

   Example:

   openssl x509 req days 365 in RENCLIENT.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out renclient1.pem -outform PEM -passout pass:pass

4. Generate a .p12 certificate for the browser.

   openssl pkcs12 -export -in <RenServer PEM file>  -out <.p12 file> -inkey 
   <Private key file> -name <alias name>

   Example:

   openssl pkcs12 -export -in renclient.pem -out renclient.p12 -inkey 
   renclient.key -M;name renclient

To install PSMCAPI certificates:

1. Generate a private key in the keystore using the following command:

   <PS_HOME>\jre\bin\keytool genkey dname CN=Company Name, 
   OU=Organization Unit, O=M;Organization, L=Locality, S=State/Provenance, 
   C=Country alias <alias Name>  -M;keyalg RSA validity 365 keystore 
   <PS_HOME>\jre\lib\cacerts storepass changeit keypass password

2. Generate the CSR using the following command:

   PS_HOME>\jre\bin\keytool certreq alias <alias name> -file <certificate 
   file name> -keystore <full path to the Java keystore used by the CTI adapter> storepass 
   <password> keypass <password>

3. To obtain your certificate, submit the CSR to the CA that issued the selected root certificate.

4. Import the signed certificates into Java keystore using the following command:

   <PS_HOME>\jre\bin\keytool import alias <alias name> -file <certificate 
   file .pem> -keystore <full path to the Java keystore used by the CTI adapter> storepass <password> 
   keypass <password>

   Note: The clients must import the CA certificate in Java keystore of JRE of PSMCAPI for SSL communication with the REN server using the keytool command.

See Implementing Client Authentication.

Certificates that are used to secure a Web server can be reused to secure a REN server. The Java keystore that stores these certificates can be converted to a PKCS #12 keystore. Subsequently, you can configure the REN server to use the newly created external PKCS #12 keystore when you define a REN server the SSL and the UseExternalKeystore options are selected.

To convert a Java keystore to a PKCS #12 keystore, you can use the PSExportToPKCS12.bat file that is delivered by Oracle.

1. Access PS_HOME/peoplesoft/Piabin and locate the PSExportToPKCS12.bat file.

   Note: Ensure that the JAVA_HOME environment variable is set correctly.

2. Run the PSExportToPKCS12.bat in Windows or PSExportToPKCS12.sh in UNIX.

   Note: The PSExportToPKCS12.bat and PSExportToPKCS12.sh scripts must be run using a version of the Sun Java Runtime environment compatible with your PeopleTools installation.

   Image: Convert Java keystore to PKCS #12 keystore

   This example illustrates the conversion of Java keystore to PKCS #12 keystore using the PSExportToPKCS12.bat file.

   

   Note: The PSExportToPKCS12.bat file must be run prior to defining a REN server in the REN Server Configuration page. The file must not be run during the boot sequence of the application server.

3. Enter values for the following:

   • Source Java Keystore — the full path of Java Keystore.

   • Source Keystore Password — the password of the Java Keystore

   • Source Keystore Alias — alias of the KeyPair in the Java Keystore.

   • Source Key Password — if the password is the same as Source Keystore Password, you can leave it blank.

   • Destination Keystore — the full path of exported PKCS #12 keystore including the file extension (.p12 is preferred).

   • Destination Keystore Password — the password of exported keystore.

   • Destination Alias — alias of the KeyPair in exported keystore.

   • Destination Trusted Store — the full path of the exported TrustStore file including the file extension (.pem is preferred).

   The Java Keystore is converted to PKCS #12 keystore.