...

• On the Agent server create the keystore using openssl and the keytool from your Java JRE or JDK. Alternatively import a private key and certificate that you received from your Certificate Authority:
  • For use with a third party utility create a keystore, e.g. https-keystore.p12, in PKCS12 format and import:
    • the Agent private key and certificate for Server Authentication
  • The examples below show a possible approach for certificate management. However, there are other ways to achieve similar results.

    • Example for importing a private key and CA-signed certificate to a PKCS12 keystore:

      Code Block
      language bash title Example how to import a private key and CA-signed certificate to a PKCS12 keystore
      # Assume the fully qualified domain name (FQDN) of the Agent server to be "agent.example.com" # If the Agent's CA-signed certificate is provided from a pkcs12 keystore (certificate.p12), extract the certificate to a .crt file in PEM format (agent.example.com.crt) # openssl pkcs12 -in certificate.p12 -nokeys -out agent.example.com.crt # Import the Agent's private key (agent.example.com.key) and certificate (agent.example.com.crt) from PEM format to a new keystore (agent.example.com.p12) openssl pkcs12 -export -in agent.example.com.crt -inkey agent.example.com.key --name agent.example.com -out "JS7_AGENT_CONFIG_DIR/private/https-keystore.p12"

    • Example for creating a private key and self-signed certificate and import to a keystore

      • Refer to examples available from JS7 - How to create self-signed Certificates, chapter Creating a Server Certificate.

        Code Block
        language bash title Example how to create a private key and self-signed certificate
        # Creating the private key and self-signed certificate for the given validity period ./create_certificate.sh --dns=agent.example.com --days=365

      • Refer to examples available from JS7 - How to add SSL TLS Certificates to Keystore and Truststore.

        Code Block
        title Example how to add a private key and self-signed certificate to a PKCS12 keystore
        # Adding the private key and certificate to a keystore ./js7_create_certificate_store.sh \ --keystore=JS7_AGENT_CONFIG_DIR/private/https-keystore.p12 \ --key=agent.example.com.key \ --cert=agent.example.com.crt \ --alias=agent.example.com \ --password=jobscheduler

        
        When using additional arguments a truststore will be immediately created:

        Code Block
        title Example how to add a private key and self-signed certificate to a PKCS12 keystore and the Root CA Certificate to a truststore
        # Adding the private key and certificate to a keystore and truststore ./js7_create_certificate_store.sh \ --keystore=JS7_AGENT_CONFIG_DIR/private/https-keystore.p12 \   --truststore=JS7_AGENT_CONFIG_DIR/private/https-truststore.p12 \    --key=agent.example.com.key \ --cert=agent.example.com.crt \ --alias=agent.example.com \ --password=jobscheduler \ --ca-root=root-ca.crt

  • With the keystore being set up specify the relevant properties with the JS7_AGENT_CONFIG_DIR/private/private.conf configuration file:

    • Example

      Code Block
      language text title Example for private.conf file specifying the Agent keystore
      js7 { web { # keystore and truststore locations for https connections https { keystore { # Default: ${js7.config-directory}"/private/https-keystore.p12" file=${js7.config-directory}"/private/https-keystore.p12" key-password="jobscheduler" store-password="jobscheduler" } } } }

      
      

      Explanation:
      • js7.web.https.keystore.file is used for the path to the keystore.
      • js7.web.https.keystore.key-password is used for access to the private key.
      • js7.web.https.keystore.store-password is used for access to the keystore. Passwords for key access and keystore access have to match if a PKCS12 keystore type is used.
        
        
• On the Agent instance's server create the keystore using the keytool from your Java JRE or JDK or a third party utility.
  • For use with a third party utility create a truststore, e.g. https-truststore.p12, in PKCS12 format and import:
    • Root CA Certificate
  • The examples below show a possible approach for certificate management - however, there are other ways of achieving similar results.

    • Example for importing a Root CA Certificate to a PKCS12 keystoretruststore:

      Code Block
      language bash title Example how to import a Root CA Certificate to a PKCS12 keystoretruststore
      # Import Root CA Certificate in PEM format to a PKCS12 truststore (https-truststore.p12) keytool -importcert -alias "root-ca" -file "root-ca.crt" -keystore "JS7_AGENT_CONFIG_DIR/private/https-truststore.p12" -storetype PKCS12

...

• On the Controller server create the truststore using the keytool from your Java JRE or JDK or a third party utility.
  • For use with a third party utility create a truststore, e.g. https-truststore.p12, in PKCS12 format and import:
    • the Root CA Certificate
  • The examples below show a possible approach for certificate management. However, there are other ways to achieve similar results.
    

    • Example for importing a Root CA Certificate to a PKCS12 truststore:

      Code Block
      language bash title Example how to import a Root CA Certificate into a PKCS12 Truststore
      # import Root CA certificate in PEM format to a PKCS12 truststore (https-truststore.p12) keytool -importcert -alias "root-ca" -file "root-ca.crt" -keystore "JS7_CONTROLLER_CONFIG_DIR/private/https-truststore.p12" -storetype PKCS12

• On the Controller server specify the location of the truststore with the JS7_CONTROLLER_CONFIG_DIR/private/private.conf configuration file:

  • Example

    Code Block
    language text title Example for private.conf file specifying the Controller truststore
    js7 { web { # keystore and truststore locations for https connections https { truststores=[ { # Default: ${js7.config-directory}"/private/https-truststore.p12" file=${js7.config-directory}"/private/https-truststore.p12" store-password="jobscheduler" } ] } } }

    
    

    Explanation:
    • js7.web.https.truststores.file is used for the path to the truststore.
    • js7.web.https.truststores.store-password is used for access to the truststore.

...

• On the Controller server create the client keystore using the keytool from your Java JRE or JDK or a third party utility.
  • For use with a third party utility create a client keystore, e.g. https-client-keystore.p12, in PKCS12 format and import:
    • the Controller private key and certificate for Client Authentication
  • For use with keytool create the client keystore in PKCS12 or JKS format according to the steps indicated in the JS7 - Controller HTTPS Connections: Step 1: Creating the Controller Keystore article.
    • Apply the steps described to the client keystore and use the private key/certificate pair for Client Authentication.

• The location of the client keystore is added to the JS7_CONTROLLER_CONFIG_DIR/private/private.conf configuration file as shown:

  • Example for PKCS12 client keystore:

    Code Block
    language text title Example how to specify the client keystore location with private.conf file
    js7 { web { # keystore and truststore location for https connections https { client-keystore { # Default: ${js7.config-directory}"/private/https-client-keystore.p12" file=${js7.config-directory}"/private/https-client-keystore.p12" key-password="jobscheduler" store-password="jobscheduler" } } } }

...