All certificates and keys are stored in the Tomcat keystore. To check the certificates stored in the keystore, run the following command:

keytool -keystore $INSTALL_ROOT/apache-tomcat/conf/keystore -list -v

For information on using keytool, see Java Keytool.

To generate the certificate and add it to the default keystore, run the following command:

  $INSTALL_ROOT/java/bin/keytool -genkey -keyalg RSA -sigalg SHA256withRSA 
  -keystore $INSTALL_ROOT/apache-tomcat/conf/keystore -alias tomcat 
  -validity 365 -keysize 2048

This generates a 2048-bit, RSA private key, and certificate. Further, this is the same command as used by the MySQL Enterprise Monitor installers.

To install an SSL certificate for the MySQL Enterprise Service Manager you must use the Java keytool to import the certificate into the keystore.

To import your certificate, run the following command:

      keytool -import -trustcacerts -alias mycertificate -file cert.pem -keystore myKeystore
      

If you want to import an existing certificate, which is password protected, you must convert it to a format understood by the Java keytool. The certificate must be converted from X509 to pkcs12 format using the openSSL toolkit and the following command:

        
        openssl pkcs12 -export -in [path-to-x509Cert]  -inkey [path-to-cert-private-key] 
        -out [path-to-cert-to-import-for-keystore] -name tomcat
        

To import the converted certificate, run the following command:

      $INSTALL_ROOT/java/bin/keytool -importkeystore 
  -srckeystore [path-to-cert-to-import-for-keystore] -srcstoretype pkcs12 
  -destkeystore $INSTALL_ROOT/apache-tomcat/conf/keystore 
  -deststoretype jks -srcalias tomcat -destalias tomcat
      

Restart the service manager. For more information about stopping and starting the service manager, see the instructions for Unix/Mac OS X and Microsoft Windows.

For information on SSL and MySQL Server, see Creating SSL and RSA Certificates and Keys.

To configure SSL-related options for the Agent, the following values may be placed in $INSTALL_ROOT/etc/bootstrap.properties:

An example bootstrap.properties SSL certification section:

ssl-verify-hostname=false
ssl-verify-host-certs=true
ssl-ca-keystore-path=/path/to/keystore
ssl-ca-keystore-password=password123

To import a CA certificate in PEM format to a new keystore on the Agent, execute the following:

$INSTALL_ROOT/java/bin/keytool -import -file /path/to/ca/ca.pem -alias CA_ALIAS -keystore $INSTALL_ROOT/etc/cacerts

The tool responds with the certificate details. For example:

Enter keystore password:  (the keystore will require at least a 6 character password)
Re-enter new password:

Owner: CN=serverName.com, O=MySQL AB, ST=Uppsala, C=SE
Issuer: O=MySQL AB, L=Uppsala, ST=Uppsala, C=SE
Serial number: 100002
Valid from: Fri Jan 29 12:56:49 CET 2010 until: Wed Jan 28 12:56:49 CET 2015
Certificate fingerprints:
     MD5:  E5:FB:56:76:78:B1:0C:D7:B0:80:9F:65:06:3E:48:3E
     SHA1: 87:59:80:28:CE:15:EF:7E:F1:75:4B:76:77:5E:64:EA:B7:1D:D1:18
     SHA256: F4:0B:79:52:CF:F3:A1:A4:7F:B2:D7:C1:65:60:F0:80:93:87:D2:68:9A:A1:
             84:F4:06:6E:8E:CF:C1:F6:1B:52
     Signature algorithm name: MD5withRSA
     Version: 1
Trust this certificate? [no]: (type yes + enter)
Certificate was added to keystore

You must edit the ssl-ca-* configuration values in bootstrap.properties accordingly, to use the path to the keystore and password.

SSL configuration for LDAP is configured at the MySQL Enterprise Service Manager Java VM level. That is, it is configured in the keystore of the Java VM bundled with your MySQL Enterprise Monitor installation.

The steps described in this section assume your LDAP server is correctly configured and you have a root CA certificate which was used to generate the LDAP server's certificate.

To enable SSL for LDAP and MySQL Enterprise Service Manager, you must do the following: