1. Essbase Independent Deployment
  2. Secure Your Communication and Network
  3. Replace Self-Signed Certificates with CA Certificates

Replace Self-Signed Certificates with CA Certificates

You can replace self-signed certificates with certificates sent by Certificate Authority (CA) company. After running the update tool, all external certificates that were added before, remain in the trust store file.

Prerequisites and Notes

  1. Configure Essbase with TLS connection. See Set up Weblogic TLS Connection for Essbase.
  2. Stop WebLogic.
  3. Set environment variables:
    • JAVA_HOME
    • ORACLE_HOME - Path to Fusion Middleware and Essbase folder
    • DOMAIN_HOME
    See Environment Locations in the Essbase Platform.
  4. Validate content of Certificate Authority (CA) files:
    1. All CA-based certificate files, received from the Certificate Authority, are in PEM format (RFC 7468).
    2. One file must contain the private key; it is recommended to store it as RSA private key (RFC 3447), which supports two steps of security.
    3. All certificates in all files must form a full certificate chain, from root to user certificates.

Update tool usage and properties file parameters

Before updating certificates, the update tool backs up all necessary files. The update tool prompts you for the private key password and replaces identity and trust store with CA-based certificates.

The command to run the tool is:

For Linux:

java -jar ${ORACLE_HOME}/essbase/lib/tlsTools.jar <properties file>

For Windows:

java -jar %ORACLE_HOME%\essbase\lib\tlsTools.jar <properties file>

where

properties file is tls_tools.properties, and located at the following path:

  • for Linux: ${ORACLE_HOME}/essbase/bin/tls_tools.properties

  • for Windows: %ORACLE_HOME%\essbase\bin\tls_tools.properties

and includes the following parameter for adding CA-based certificates:

certCA=

Files in the certCA property are separated by a colon (:) in Linux, or a semicolon (;) in Windows.

If certCA parameter has a value, CA-based certificates are added; All other parameters are ignored)

Run Java command with update tool to update certificates

  1. Add certCA parameter to tls_tools.properties file, as described above.
  2. Run Java command as shown above.