1. Essbase Independent Deployment
  2. Secure Your Communication and Network
  3. Update TLS Certificates

Update TLS Certificates

You can update Transport Layer Security (TLS) self-signed certificates, when, for example, they are expired, or when you need to use several hosts for different WebLogic servers. After running the update tool, all external certificates that were added before, remain in the trust store file.

The TLS certificate update tool can be used to add or update all certificates for Essbase 21c configurations.

Prerequisites

  1. Configure Essbase with TLS connection. See Set up Weblogic TLS Connection for Essbase.
  2. Stop WebLogic.
  3. Set environment variables:
    • JAVA_HOME and PATH
    • ORACLE_HOME - Path to Fusion Middleware and Essbase folder
    • DOMAIN_HOME
    See Environment Locations in the Essbase Platform.

Update tool usage and properties file parameters

Before updating certificates, the update tool backs up all necessary files. The update tool prompts you for the private key password.

The command to run the tool is:

For Linux:

java -jar ${ORACLE_HOME}/essbase/lib/tlsTools.jar <properties file>

For Windows:

java -jar %ORACLE_HOME%\essbase\lib\tlsTools.jar <properties file>

where:

properties file is tls_tools.properties, and located at the following path:

  • for Linux: ${ORACLE_HOME}/essbase/bin/tls_tools.properties

  • for Windows: %ORACLE_HOME%\essbase\bin\tls_tools.properties

and includes the following parameter, to add external certificates to Essbase: 

SAN=

SAN (Subject Alternative Name) parameter, which has no value by default, lets you specify the IP addresses and domain names that must be secured by the certificate update. Provide a value to the SAN parameter to indicate how Essbase should update the certificates. If the SAN parameter has a value, all external, self-signed certificates are added. If all parameters are empty of values, all existing certificates in the Essbase environment are updated.

The format is shown below. A; all names must be separated by commas. 
SAN="DNS:<hostname>,IP:<ip address>"
For example: 
SAN=IP:10.x.x.11,IP:10.x.x.13,IP:10.x.x.17,DNS:myhost,DNS:myhost.example.com

Run Java command with update tool to update certificates

  1. Add SAN parameter to tls_tools.properties file, as described above.
  2. Run Java command as shown above.