When you install the OpenEdge Command Center server and OpenEdge Command Center agent on a Windows or Linux platform, mutual TLS authentication is configured with default certificates. You can configure mutual TLS authentication with your signed certificates.
Note: Progress recommends using only valid TLS certificates issued by a trusted certificate authority for production environments in OpenEdge Command Center. Ensure that all TLS certificates are generated with a key size of at least 3072 bits to comply with the enhanced security standards of OpenEdge Command Center. The nohostverify switch is intended for convenience and you must use it only as a temporary measure during development.

Before you begin, ensure that you have administrator privileges.

Configure mutual TLS authentication with custom certificates

To configure mutual TLS authentication with your signed certificates, perform the following steps:

  1. Configure the OpenEdge Command Center agent to use your signed certificates:
    1. Stop the agent.
    2. Run the following command by providing values for pKeyAlias, pKeyPath, certPath, rootCAAlias and rootCAPath.
      java -jar <Agent_Root_Directory>\install\installer-util-2.0.0.jar fileName=agentConfig pKeyAlias=<key alias>  pKeyPath=<key path> certPath=<.crt path> rootCAAlias=<ca alias> rootCAPath=<root ca .crt path>
      where:
      • pKeyAlias: Alias for the agent private key.
      • pKeyPath: Path to the private key file for the agent.
      • certPath: Path to the certificate file for the agent.
      • rootCAAlias: Alias for the root CA certificate.
      • rootCAPath: Path to the root CA certificate file. It must be the same root CA that signed the server certificate.
    3. Restart the agent.
  2. Configure the OpenEdge Command Center server to use your signed certificates:
    1. Stop the server.
    2. Navigate to the <Server_Install_Directory>\conf\certs for Windows or <Server_Install_Directory>/conf/certs for Linux.
    3. Add the server certificate files.
    4. Navigate to the server-config.json file located in <Server_Install_Directory>\conf for Windows or <Server_Install_Directory>/conf for Linux, and then open the file.
    5. Update any or all the values for the following attributes in the server-config.json file:
      • key: Path to the private key file for the server.
      • keyPassPhrase: Passphrase for the private key.
      • certificate: Path to the public certificate for the server, signed by the root CA.
      • rootCA: Path to the root CA certificate.
      For more details about attribute descriptions and file structure, see Server configuration file.
    6. Restart the server.

    Mutual TLS authentication is configured with signed certificates provided by you.

Reset mutual TLS authentication to use default certificates

To reset mutual TLS authentication to use the default certificates, perform the following steps:
  1. Restore default certificates on the OpenEdge Command Center agent:
    1. Stop the agent.
    2. Run the following command:
      java -jar <Agent_Root_Directory>\install\installer-util-2.0.0.jar fileName=agentConfig
    3. Restart the agent.
  2. Restore default certificates on the OpenEdge Command Center server:
    1. Stop the server.
    2. Navigate to the orig/certs folder and copy the default certificates from the folder to the conf/certs folder:
      • On Windows, copy certificates from <Server_Install_Directory>\orig\certs to <Server_Install_Directory>\conf\certs.
      • On Linux, copy certificates from <Server_Install_Directory>/orig/certs to <Server_Install_Directory>/conf/certs.
    3. Navigate to the server-config.json file located in <Server_Install_Directory>\conf for Windows or <Server_Install_Directory>/conf for Linux, and then open the file.
    4. Update the values of the attributes you previously modified in the server-config.json file to their default values. For more details about attribute descriptions and file structure, see Server configuration file.
    5. Restart the server.

    The configuration of mutual TLS authentication with signed certificates provided by you is reset to the one with default certificates. The nohostverify property is also set to its default value of true.