Foglight for Virtualization Enterprise Edition 8.9.3 - Installing Foglight on Windows with an External PostgreSQL Database

If you do not choose to install Foglight in Secure Server mode, you can edit server.config after installation and manually configure Foglight to restrict the Management Server to use the HTTPS port when accessing the browser interface.

You must have a signed, valid certificate to use this HTTPS configuration. It is recommended that you obtain a valid certificate from a third party as outlined in Importing a network security certificate.

To configure the Management Server to use the HTTPS port:

Stop the Management Server.

Open the file <foglight_home>\config\server.config on the Management Server machine.

Set the parameter server.console.httpsonly to true:

server.console.httpsonly = "true";

Save the server.config file.

Import the signed certificate into the Foglight keystore. See Importing a network security certificate for instructions.

Restart the Management Server.

Launch the Foglight browser interface using the appropriate HTTPS URL (https://<hostname>:<https_port>) to ensure that the Management Server can be accessed using HTTPS.


	NOTE: The Foglight Management Server uses the HTTP port for local access even if you are accessing the browser interface through an HTTPS connection. If that is the case, both ports are open: the HTTPS port for external requests coming from the browser interface and the HTTP port for local requests. For example, the reporting service accesses the Foglight Management Server through the HTTP port while external requests use HTTPS. You must configure your firewall or network security applications to allow both ports to remain open.

Importing a network security certificate

In order to set up the Foglight Management Server to use HTTPS, you must generate a key pair (security certificate) into the Foglight keystore. This security certificate allows the server to communicate through the HTTPS protocol. Delete the existing certificate shipped with Foglight before generating a new key pair. Use the keytool utility shipped with Foglight to create, import, and export certificates. This utility can be found at:

<foglight_home>\jre\bin\keytool.exe

There are two keystores that Foglight uses:

•

The built-in Tomcat™ keystore located at:
<foglight_home>\config\tomcat.keystore (default password: nitrogen)

<foglight_home>\config\tomcat_fips.keystore (For FIPS compliance mode, default password: nitrogen)

•

The Management Server keystore located at:
<foglight_home>\jre\lib\security\cacerts (default password: changeit)

To import a certificate:

Back up the existing tomcat key using the following command:

cd <foglight_home>\config
cp tomcat.keystore <your_backup_key>

Delete the existing tomcat key from the tomcat.keystore directory using the following command:

<foglight_home>\jre\bin\keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -delete

Create a new key under the tomcat alias using the following command:

<foglight_home>\jre\bin\keytool -keystore tomcat.keystore -storepass nitrogen -genkeypair -alias tomcat -validity <number of days> -keyalg RSA -keysize 2048 -dname "CN=<your_fmsserver_dns_name>, OU=<your_organizational unit_name>, O=<your_organization_name>, L=<your_city_name>, ST=<your_state_name>, C=<your_two-letter_country_code>" -ext SAN=dns:<your_fmsserver_dns_name>,ip:<your_fmsserver_ip>

Generate a Certificate Signing Request (CSR) using the following command:

<foglight_home>\jre\bin\keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -validity <number of days> -certreq -ext san=dns:<your_fmsserver_dns_name>,ip:<your_fmsserver_ip> -file <your_request_file.csr>

This file must be signed by Certification Authority (CA).

Once you have the certificate signed, import it back to the tomcat.keystore using the following command:

<foglight_home>\jre\bin\keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -validity <number of days> -trustcacerts -import -file <your_converted_cerificate>

When importing a certificate for Foglight in FIPS-compliant mode, continue with the following steps:

Backup the default tomcat FIPS keystore using the following command:

cp tomcat_fips.keystore <your_backup_key>

Covert tomcat.keystore from JKS format to FIPS-verified BCFKS format using the following command:

<foglight_home>\jre\bin\keytool -importkeystore -srckeystore tomcat.keystore -destkeystore tomcat_fips.keystore -deststoretype BCFKS -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath <foglight_home>\server\core\bc-fips.jar

You will get a prompted message similar to the following:... is not trusted. Install reply anyway? [no]:

Type yes to install the new certificate.

The following is an example of commands for importing a certificate.

cd <foglight_home>/config
cp tomcat.keystore tomcat.keystore.backup
<foglight_home>/jre/bin/keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -delete
<foglight_home>/jre/bin/keytool -keystore tomcat.keystore -storepass nitrogen -genkeypair -alias tomcat -validity 730 -keyalg RSA -keysize 2048 -dname "CN=fms.quest.com, OU=Foglight, O=Quest, L=Aliso Viejo, ST=CA, C=US" -ext SAN=dns:fms.quest.com,ip:192.168.1.1
<foglight_home>/jre/bin/keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -validity 730 -certreq -ext san=dns:fms.quest.com,ip:192.168.1.1 -file san.p7b
<foglight_home>/jre/bin/keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -validity 730 -trustcacerts -import -file san.p7b

Importing a PKCS #12 (pfx) format certificate

If you have an existing SSL certificate and you want to use this certificate in Tomcat, follow the steps below to import this SSL certificate.


	NOTE: This certificate must be provided in the PKCS #12 (pfx) format. If the certificate and private key are saved in separate files, run the following command to merge them to the PKCS12 format: openssl pkcs12 -export -in <certfile> -inkey <keyfile> -out <keystorefile> -name tomcat -CAfile <cacertfile> -caname root

To import a certificate in Tomcat:

Delete the existing tomcat certificate from the tomcat.keystore directory using the following command:

<foglight_home>\jre\bin\keytool -keystore tomcat.keystore -storepass nitrogen -alias tomcat -delete

Obtain the certificate’s alias name from the certificate PFX file using the following command:

<foglight_home>\jre\bin\keytool -keystore <your certificate pfx file> -storepass <certificate pfx password> -list -v

The following is an example of command output. The value of Alias name is required in step 3.

Your keystore contains 1 entry

Alias name: tq-294043e3-fd9d-42ee-a596-0217c7d6d5f8

Creation date: May 8, 2020

Entry type: PrivateKeyEntry

Merge the Tomcat keystore and the PKCS12 keystore using the following command:

<foglight_home>\jre\bin\keytool -importkeystore -destkeystore tomcat.keystore -deststorepass nitrogen -destalias tomcat -srckeystore <your certificate pfx file> -srcstorepass <certificate pfx password> -srcstoretype pkcs12 -srcalias <alias name in step 2>