A footnote to my last post...
After posting, I installed the new JKS through the IMC GUI, which I've done many times before.
I shutdown and started IMC, but the Web wouldn't come up. I tracked down the error, and found that the C:\Program Files\iMC\client\conf\server.xml file was zero bytes! Since my IMC is a VM, I had snapshot, and just rolled it back. The same issue occured!
I was running iMC_PLAT_7.3_E0705P10_windows, so there may be a bug, but I honestly didn't spend much (any) time looking into it. Instead, automated the footnote remarks at the bottom of my PS script.
The additional part works thus..
1. Check to see if the process 'img' is running, If so, throw up a warning to stop IMC, and end script.
2. If not running backup existing keystore, and any old 'new' certificate imports.
3. Move the JKS (newks_imc) to the security folder, to be processed when IMC is started
After this, IMC's GUI came up with the new cert. I did update to 7.3_E0705P12, and tried re-installing the new cert via IMC's GUI. I restarted, and had no issues.
So if it was a bug, perhapse it got fixed, and if just happened to be bad luck (twice) at least the script will help make the process all the more simple.
I'm posting version 1.1 with the extra instalation automation.
Update: 1.11, fixed moving JKS across file systems, due to feedback from Racowi.
##################################################################################
## Description
## Powershell automation for importing a PKCS12 Certificate in the IMC Web UI.
##
## -------------------------------------------------------------------------------
## Author:
## John Maier - MASE and a bunch other HPE Aruba stuff.
##
## -------------------------------------------------------------------------------
## Revision 1.00 - 2021-09-21 - Inital release
## Revision 1.10 - 2021-09-22 - Added auto JKS install if IMC isn't running.
## Revision 1.11 - 2021-10-04 - Change Rename-Item to Move-Item when installing JKS to IMC security directory. - Thanks to Racowi
## -------------------------------------------------------------------------------
## Credit, where Credit is due:
## Process taken and adapted from Webposts
## https://www.flomain.de/2014/10/how-to-imc-webserver-certificate/
## https://community.hpe.com/t5/IMC/Certificate-in-iMC/td-p/2314848#.YUozxis3laQ
##
## -------------------------------------------------------------------------------
## Disclaimer:
## The author make no warranty as to the fitness, or accuracy of this code.
##
## Use freely as needed.
## If this script helps make your life easier, simply think kindly of me. :-)
## giving me a Kudo on my post is a nice way to stroke my ego too.
## -------------------------------------------------------------------------------
## Contact:
## Via Airheads or community.hpe.com
##################################################################################
# Step 1: -----------------------------------------------------------------------------------------------------------------#
### - Obtain a new certificate from a Certificate Authority (CA) as a password protected PKCS12 file.
# Step 2: -----------------------------------------------------------------------------------------------------------------#
# - Create a work directory, as needed.
# - directory where Certificate work will be performed i.e. C:\IMCCert\" or for *nix ./IMCCert
$IMC_TLS_Work_Dir = "C:\IMCCert\"
# Step 3: ------- Edit ---- Edit ---- Edit ---- Edit ---- Edit ---- Edit ------- #
# - place the PKCS12 file in work directory
# - File name of new IMC Certificate obtained from a CA
$PFX_Filename = "imc.pfx"
# - Password that was used to secure the PFX certificate export file.
$pkcs12passwd = "ChangeMeToYourPFXpass"
# Step 4: -----------------------------------------------------------------------------------------------------------------#
# Variable setup - changes, below this point, shouldn't be needed for a typical Windows install,
# except to adapt for a customized Windows install, or for a IMC on *nix install.
# - Where IMC binary exec tools are located -
# For Windows, typically: C:\Program Files\iMC\deploy\jdk\bin\
# for *inx, typically: /opt/iMC/deploy/jdk/bin/
$IMC_Bin_Dir = "C:\Program Files\iMC\deploy\jdk\bin\"
# - For making backups of existing files.
$revison_num = Get-Date -Format "yyyyMMddHHmm"
# - Source of new IMC Certificate obtained from a CA
$JKS_Filename = "newks_imc"
# - Password to be used to for securing the JKS
# - Note: I typically keep the JKS (Java Key Store) password the same as the PKCS12 password, to avoid confusion, but do as you wish.
$JKSpasswd = $pkcs12passwd
# Full Path and name of files for Cert work.
$NewCertPFX= $IMC_TLS_Work_Dir+$PFX_Filename
$JKStoreFile=$IMC_TLS_Work_Dir+$JKS_Filename
$KeyToolCmd= $IMC_Bin_Dir+"keytool.exe"
# Step 5: -----------------------------------------------------------------------------------------------------------------#
# Test for previous JKS file and rename it, if needed.
if (Test-Path $JKStoreFile -PathType leaf) {
$JKSBackup = $JKStoreFile+"_"+$revison_num
Rename-Item -Path $JKStoreFile -NewName $JKSBackup
}
# Step 6: -----------------------------------------------------------------------------------------------------------------#
Write-Host ""
Write-Host "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
Write-Host " NOTICE! NOTICE! NOTICE! NOTICE! NOTICE!"
Write-Host ""
Write-Host " The Warnings, keytool generates, can safely be ignored."
Write-Host ""
Write-Host " NOTICE! NOTICE! NOTICE! NOTICE!"
Write-Host "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
Write-Host ""
Write-Host "**************************************************************************"
Write-Host ""
Write-Host " Copy Certificate, private key, etc from PKCS12 formate to JKS"
Write-Host ""
Write-Host "**************************************************************************"
& $KeyToolCmd -importkeystore -srckeystore $NewCertPFX -destkeystore $JKStoreFile -srcstoretype pkcs12 -deststoretype JKS -storepass $JKSpasswd
# Manual Input: $pkcs12passwd
# Step 7: -----------------------------------------------------------------------------------------------------------------#
### - Get Alias name of imported PKCS12 certificate and test ###
$AliasName = & $KeyToolCmd -list -v -keystore "$JKStoreFile" -storepass $JKSpasswd | findstr /B /L "Alias name"
$AliasName = $AliasName.Split(":")[1]
$AliasName = $AliasName.Substring(1,$AliasName.Length-1)
if (($AliasName.Length -eq 0) -or !(Test-Path $JKStoreFile -PathType leaf)) {
Write-Host ""
Write-Host "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
Write-Host " NOTICE! NOTICE! NOTICE! NOTICE! NOTICE!"
Write-Host ""
Write-Host " !!! The certficate import failed !!!"
Write-Host " Please review and restart the process"
Write-Host ""
Write-Host " NOTICE! NOTICE! NOTICE! NOTICE!"
Write-Host "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
} else {
Write-Host ""
Write-Host "********************************************************************************************************"
Write-Host ""
Write-Host " The imported JKS Certificate Alias: $AliasName"
Write-Host ""
Write-Host "********************************************************************************************************"
# Step 8: -----------------------------------------------------------------------------------------------------------------#
Write-Host ""
Write-Host "********************************************************************************************************"
Write-Host ""
Write-Host " Copying alias $AliasName to alias 'imc' in JKS"
Write-Host ""
Write-Host "********************************************************************************************************"
& $KeyToolCmd -keyclone -keystore $JKStoreFile -alias "$AliasName" -storepass $JKSpasswd -dest imc
# Manual Input: [Enter Key] - keeps the certificate copy password the same as orginal PKCS12 cert password.
# Step 9: -----------------------------------------------------------------------------------------------------------------#
# Verify the alias copy was successful
$AliasVerify = & $KeyToolCmd -list -v -keystore "$JKStoreFile" -storepass $JKSpasswd | findstr /R "\:.imc"
$AliasVerify = $AliasVerify.Split(":")[1]
$AliasVerify = $AliasVerify.Substring(1,$AliasVerify.Length-1)
if ($AliasVerify -eq "imc") {
Write-Host "Alias "$AliasName" copied successfully to imc"
# Step 10: -----------------------------------------------------------------------------------------------------------------#
### - delete the original keystore alias entry, from newks_imc, leaving just the alias 'imc' entry.
Write-Host ""
Write-Host "********************************************************************************************************"
Write-Host ""
Write-Host " Deleting $AliasName from JKS..."
Write-Host ""
Write-Host "********************************************************************************************************"
& $KeyToolCmd -delete -keystore $JKStoreFile -alias "$AliasName" -storepass $JKSpasswd
# Step 11: -----------------------------------------------------------------------------------------------------------------#
### - Verify our work: The original certificate alias entry, imported into the keystore, should be gone.
### - Only the certificate alias 'imc' should remain in the JKS
$AliasVerify = & $KeyToolCmd -list -v -keystore "$JKStoreFile" -storepass $JKSpasswd | findstr $AliasName
if ($AliasVerify.Length -eq 0) {
Write-Host ""
Write-Host "********************************************************************************************************"
Write-Host ""
Write-Host " $AliasName successfully deleted from JKS"
Write-Host ""
Write-Host " !!! JKS certifcate store is ready to be imported into IMC !!!"
Write-Host ""
Write-Host " Log into iMC GUI, where IMC Certificate work was performed; most likely on the IMC server."
Write-Host " Note: If browser will not allow HTTPS access, use http://localhost:8080"
Write-Host ""
Write-Host " Open IMC and go to SystemтАУ>System ConfigurationтАУ>HTTPS Access Settings"
Write-Host " Import $JKStoreFile using password $pkcs12passwd"
Write-Host ""
Write-Host " Once installed, open the Intelligent Deployment Monitoring Agent GUI, Stop and then start IMC."
Write-Host ""
Write-Host " Note: Restarting the Windows IMC services will not cause IMC to load the new certifcate."
Write-Host ""
Write-Host "********************************************************************************************************"
} else {
Write-Host ""
Write-Host "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
Write-Host " NOTICE! NOTICE! NOTICE! NOTICE! NOTICE!"
Write-Host ""
Write-Host " !!! The alias delete seems to have failed !!!"
Write-Host " Please review and restart the process"
Write-Host ""
Write-Host " NOTICE! NOTICE! NOTICE! NOTICE!"
Write-Host "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
}
}
}
# -- Only proceed to install the new certificate if IMC is not running.
$IMC_Process_name = 'img';
$arrService = Get-Process -Name $IMC_Process_name -ErrorAction SilentlyContinue
if ($arrService.Responding -eq $True) {
Write-Host ""
Write-Host "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
Write-Host " NOTICE! NOTICE! NOTICE! NOTICE! NOTICE!"
Write-Host ""
Write-Host " !!! IMC is still running. !!!"
Write-Host " Before proceeding to install the new cert: "
Write-Host " Open the Intelligent Deployment Monitoring Agent GUI and Stop IMC."
Write-Host " Once IMC has stopped, then re-run this to install the new Cert."
Write-Host ""
Write-Host " NOTICE! NOTICE! NOTICE! NOTICE!"
Write-Host "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
} else {
$IMC_Security_Dir = "C:\Program Files\iMC\client\security\"
# -- Backup of IMC's keystore file.
$IMCStoreFile=$IMC_Security_Dir+"keystore"
if (Test-Path $JKStoreFile -PathType leaf) {
$IMCStoreBackup = $IMCStoreFile+"_"+$revison_num
Rename-Item -Path $IMCStoreFile -NewName $IMCStoreBackup
}
# -- backup any old 'new' certificate work from the past.
$IMCNewKeyFile=$IMC_Security_Dir+$JKS_Filename
if (Test-Path $IMCNewKeyFile -PathType leaf) {
$IMCNewKeyBackup = $IMCNewKeyFile+"_"+$revison_num
Rename-Item -Path $IMCNewKeyFile -NewName $IMCNewKeyBackup
}
# - Move the JKS work file to the IMC security folder to be processed when IMC starts.
Move-Item -Path $JKStoreFile $IMCNewKeyFile
if (Test-Path $IMCNewKeyFile -PathType leaf) {
Write-Host ""
Write-Host "********************************************************************************************************"
Write-Host ""
Write-Host " The New Key Certificate has bee succesfully moved to IMC. "
Write-Host " IMC is ready to be started, to apply the new certificate."
Write-Host ""
Write-Host "********************************************************************************************************"
}
}
