Enabling SSL for JMX Agents

Enabling SSL for JMX ensures that the communication between JMX agents and Logstash is secure. Additionally, the information exchanged between agents and client is encrypted with SSL keystore and only trusted agents and clients can connect with the agent.

To enable SSL for JMX agents, complete these steps:

  1. Either use the default keystore pskey or generate your own keystore.

    If you plan to generate your own keystore, complete these steps. Ensure that you specify correct values in the placeholders (< >).

    1. Create Certificate Signing request (CSR).

      keytool -certreq -alias <alias> -keypass -keystore PS_HOME/mykeystore -storepass <password> -file <mycsr.cer> -sigalg SHA256withRSA -ext SAN=dns:<domain name>

    2. Use the CSR to get a certificate from CA. Download it and save it locally, for example, /home/certs/signed.cer.

    3. Import the signed certificate into the keystore.

      keytool -trustcacerts -keystore mykeystore -storepass <password> -importcert -alias <alias> -file </home/certs/signed.cer>

    4. Download Root CA and import it.

      keytool -keystore <mykeystore> -storepass <password> -importcert -alias <alias> -file <RootCA.cer>

  2. Configure JMX SSL settings for the application server and Process Scheduler domains using pskey or generated keystore and ensure that the domains are started successfully.

    In the configuration file, in the PSTOOLS section, locate the following parameters and set the values. In the previous topic, Enabling JMX Agents, you have set values for some of the parameters.

    • Remote Administration SSL Enabled

      Change the value to 1 to enable SSL for JMX agents, and to 0 to disable. The default is 0, disabled. When you enable SSL for JMX agents, you must also specify the location, password, and type for the keystore and truststore.

    • Remote Administration SSL Keystore

      Specify the location of the keystore for SSL.

    • Remote Administration SSL Keystore Password

      Specify the password for the SSL keystore. The password must be encrypted with PSCipher.

      See Security Administration: Using the PSCipher Utility.

    • Remote Administration SSL Keystore Type

      Specify the keystore type, PKCS12 or JKS.

    • Remote Administration SSL Truststore

      Specify the location of the truststore for SSL.

    • Remote Administration SSL Truststore Password

      Specify the password for the SSL truststore. The password must be encrypted with PSCipher.

      See Security Administration: Using the PSCipher Utility.

    • Remote Administration SSL Truststore Type

      Specify the truststore type, PKCS12 or JKS.

For additional information, refer to the Generating JSON Files, Fetching Threshold Parameters, and Sending Alerts with an SSL Setup topic in PeopleSoft Deployment Packages Installation for Search Components (PeopleSoft PeopleTools 8.60).

Related Topics