4.4 Install Operator CA Trust Files

Copy the required Operator CA trust certificates to the OCLM node by using a customer-approved secure transfer method. Stage the files in /home/admusr/oclm-staging/operator-ca-trust, install them into /opt/oclm-service, and remove the staged copies after successful installation.

The following table provides trust files used by Operator CA configuration:

Table 4-1 Trust Files

File	Required	When to Install	Configuration Property
/opt/oclm-service/operator-ca-root.pem	Mandatory	Always required. This is the trust anchor used to verify certificates issued by Operator CA.	cmp.rootCACerts
/opt/oclm-service/operator-ca-intermediate.pem	Conditional	Install only when Operator CA issues certificates from an intermediate CA or when the issued certificate chain cannot be verified with the root CA alone. If only the root CA is used, this file is not required.	cmp.rootCACerts
/opt/oclm-service/operator-ca-tls-root.pem	Conditional	Install only when the CMP endpoint uses HTTPS and cmp.enableTLS=true. If cmp.enableTLS=false, or the CMP endpoint does not require TLS validation, this file is not required.	cmp.tlsTrustedCerts

cmp.rootCACerts must include the files needed to verify certificates issued by Operator CA. If the issuing CA is the root CA, configure only the root file. If Operator CA uses an intermediate CA, configure both the intermediate and root files as a Comma-separated list. The paths in issuerConfig.properties must exactly match the installed file paths.

Example with only a root CA:

cmp.rootCACerts=/opt/oclm-service/operator-ca-root.pem

Example with an intermediate CA:

cmp.rootCACerts=/opt/oclm-service/operator-ca-intermediate.pem,/opt/oclm-service/operator-ca-root.pem

Example when CMP TLS validation is disabled:

cmp.enableTLS=false
# cmp.tlsTrustedCerts=/opt/oclm-service/operator-ca-tls-root.pem

Example when CMP TLS validation is enabled:

cmp.enableTLS=true
cmp.tlsTrustedCerts=/opt/oclm-service/operator-ca-tls-root.pem

Run the following commands to create the staging directory:

STAGE_DIR=/home/admusr/oclm-staging/operator-ca-trust
mkdir -p "$STAGE_DIR"
chmod 700 "$STAGE_DIR"

Copy only the required Operator CA trust files into $STAGE_DIR using the customer-approved secure transfer method. Then install the files from the staging directory:

sudo install -m 0644 "$STAGE_DIR/operator-ca-root.pem" /opt/oclm-service/operator-ca-root.pem
[ -f "$STAGE_DIR/operator-ca-intermediate.pem" ] && sudo install -m 0644 "$STAGE_DIR/operator-ca-intermediate.pem" /opt/oclm-service/operator-ca-intermediate.pem
[ -f "$STAGE_DIR/operator-ca-tls-root.pem" ] && sudo install -m 0644 "$STAGE_DIR/operator-ca-tls-root.pem" /opt/oclm-service/operator-ca-tls-root.pem
sudo chown admusr:admusr /opt/oclm-service/operator-ca-root.pem
[ -f /opt/oclm-service/operator-ca-intermediate.pem ] && sudo chown admusr:admusr /opt/oclm-service/operator-ca-intermediate.pem
[ -f /opt/oclm-service/operator-ca-tls-root.pem ] && sudo chown admusr:admusr /opt/oclm-service/operator-ca-tls-root.pem

Perform the following command to remove the staged copies after the files are installed:

rm -f "$STAGE_DIR"/operator-ca*.pem
rmdir "$STAGE_DIR" 2>/dev/null || true