Page Comparison

Generate a keystore 

Generate a repository of security certificates for Datameer's embedded Jetty. For this process, use keytool. 

1. Check the default keystore:

   Code Block
   language bash title Check keystore
   [datameer@<host> current]$ keytool -list -v -keystore etc/keystore | grep -i 'jetty' Enter keystore password: storepwd Alias name: jetty Owner: CN=jetty.mortbay.org, OU=Jetty, O=Mort Bay Consulting Pty Ltd, L=Unknown, ST=Unknown, C=Unknown Issuer: CN=jetty.mortbay.org, OU=Jetty, O=Mort Bay Consulting Pty Ltd, L=Unknown, ST=Unknown, C=Unknown

2. Back up the default keystore file:

   Code Block
   language bash title Backup keystore
   mv etc/keystore etc/keystore.original

3. Create a new Java KeyStore (JKS) file using the datameer.p12 file that was generated previously. The keystore needs to be protected by a password. 

   Code Block
   language bash title Create keystore
   keytool -importkeystore -srckeystore datameer.p12 -srcstoretype PKCS12 -destkeystore etc/keystore

   For the keystore password you can use storepwd. 

4. Obfuscate the password:

   Code Block
   language bash title Obfuscate password
   [datameer@<host> current]$ java -cp lib/jetty-util-* org.eclipse.jetty.util.security.Password datameer storepwd <timestamp>:INFO::main: Logging initialized @75ms storepwd OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4 MD5:7bfa04a176c6d48e5283e1c037e4668e CRYPT:dake2.vBb3e52

   The obfuscated keystore password, in this example OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4 for storepwd, needs to be provided later as jetty.keystore.password in Jetty's start.ini file. 

5. Check the generated repository:

   Code Block
   language bash title Check keystore
   [datameer@<host> current]$ keytool -list -v -keystore etc/keystore | grep -i 'datameer' Enter keystore password: storepwd Alias name: datameer Owner: <...> Issuer: <...>

Use your own keystore

To use the custom certificate stored in the created Java KeyStore (JKS) file, configure the start up configuration file. 

1. Check the current configuration:

   Code Block
   language bash title Check current config
   # The path to the keystore file [datameer@<host> current]$ java -jar start.jar --list-config | grep -i 'store =' jetty.keystore = etc/keystore jetty.truststore = etc/keystore # The necessary passwords [datameer@<host> current]$ java -jar start.jar --list-config | grep -i 'password' jetty.keymanager.password = OBF:1u2u1wml1z7s1z7a1wnl1u2g jetty.keystore.password = OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4 jetty.truststore.password = OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4

2. Back up the default configuration:

   Code Block
   language bash title Backup config
   cp start.ini start.ini.original

3. Configure start.ini:

   Info
   icon false
   Since this example uses default values, no changes are necessary.

   Code Block
   language bash title Configure start.ini
   ## Set up a demonstration keystore and truststore jetty.keystore=etc/keystore jetty.truststore=etc/keystore ## Set the demonstration passwords ## Note that OBF passwords are not secure, just protected from casual observation ## See http://www.eclipse.org/jetty/documentation/current/configuring-security-secure-passwords.html jetty.keystore.password=OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4 # storepwd jetty.keymanager.password=OBF:1u2u1wml1z7s1z7a1wnl1u2g # keypwd jetty.truststore.password=OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4 # storepwd

4. Create a configuration change log:

   Code Block
   language bash title Create changelog
   diff -e start.ini.original start.ini > changes.start.ini

5. Restart Datameer to make the change active and monitor the boot process:

   Code Block
   language bash title Start and monitor
   dmstart dmlog

Renew certificate

Certificates typically have an expiration date, so it is necessary to renew them. To do, so just follow the following steps again:

• Get own certificate

• Generate own keystore

• Use own keystore

Anchor
trustcertificates trustcertificates

Trusting Custom Certificates from Other Services

The Java Virtual Machine (JVM) enforces security and validates the certification path to the requested target. If the certificate isn't provided from a generally trusted root certificate, you need to trust the certificate by adding it into the truststore of the Java Virtual Machine (JVM) that runs Datameer. 

• Gather the certificate:

  Code Block
  language bash title Gather certificate
  openssl s_client -connect <host>.<domain>.<tld>:<port> -showcerts </dev/null 2>/dev/null | openssl x509 -outform PEM > <yourservice>.pem

• Validate the certificate:

  Code Block
  language bash title Validate certificate
  openssl x509 -in <yourservice>.pem -inform pem -noout -text

• Trust the certificate by importing it:

  Code Block
  language bash title Import certificate
  sudo keytool -keystore ${JAVA_HOME}/jre/lib/security/cacerts -storepass changeit -import -trustcacerts -v -alias <yourservice> -file <yourservice>.pem

• Start and stop Datameer service:

  Code Block
  language bash title Start and stop
  dmstop # This will create a new instance of the JVM dmstart dmlog

Further Information 

For more information, refer to the Secure Socket Extension (JSSE) Reference Guide.  

You can also review available documentation from Hadoop distributors, such as Creating Java Keystores and Truststores, Understanding the SSL Keystore Factory, and Demystify LDAP, SSL, CA Cert integration. If you want to connect to an specific service, see vendor documentation such as Configure External SSL for Tableau.