Related product: IBM Defender Connection Manager
Idea: Establish a process in the Connection Manager GUI or on cmd line (similar to the backup / restore script) to create a new CSR = Certificate Signing Request and install a client provided certificate (and private key).
Background: The SSL certificate of the connection manager must be changeable to a CA signed certificate because the self signed certificate that is being created after the OVA deployment does not contain proper Subject Alternate Names. In addition, clients will force us to replace HTTPS certificates of webservers in their premise to use certificates that are issued by their own Certification Authority.
openssl s_client -connect defender-connection-manager.ibm.lab:443
Here an example of a certificate with the Subject Alternate Name filled:
[root@defender-control-node1 anchors]# openssl s_client -connect vcenter.ibm.lab:443 -showcerts <<< Q
CONNECTED(00000003)
depth=2 C = DE, O = IBM, OU = ClientEngineeing, CN = ROOTCA
verify return:1
depth=1 C = DE, O = IBM, OU = ClientEngineering, CN = ICA
verify return:1
depth=0 C = DE, ST = Hessen, L = Frankfurt, O = Client Engineerung, OU = Global Sales, CN = vcenter.ibm.lab
verify return:1
---
Certificate chain
0 s:C = DE, ST = Hessen, L = Frankfurt, O = Client Engineerung, OU = Global Sales, CN = vcenter.ibm.lab
i:C = DE, O = IBM, OU = ClientEngineering, CN = ICA
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Aug 16 08:18:36 2024 GMT; NotAfter: Aug 16 08:18:36 2026 GMT
-----BEGIN CERTIFICATE-----
...
...
REKsxjNeqeW2Aw4jS+CA0mNLUyFH2x+eKqCZDPbV4aME+E8oQq8=
-----END CERTIFICATE-----
1 s:C = DE, O = IBM, OU = ClientEngineering, CN = ICA
i:C = DE, O = IBM, OU = ClientEngineeing, CN = ROOTCA
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Aug 11 17:07:17 2023 GMT; NotAfter: Aug 11 17:17:17 2033 GMT
-----BEGIN CERTIFICATE-----
...
8auH92VePUDjt//zPGsLYCN9w6qM1/I=
-----END CERTIFICATE-----
---
Server certificate
subject=C = DE, ST = Hessen, L = Frankfurt, O = Client Engineerung, OU = Global Sales, CN = vcenter.ibm.lab
issuer=C = DE, O = IBM, OU = ClientEngineering, CN = ICA
---
No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, prime256v1, 256 bits
---
SSL handshake has read 3182 bytes and written 445 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: D3E8D70BE98DDBD594AD335683A9CE0610464655BED1A7A564B85A98656AA25F
Session-ID-ctx:
Master-Key: DC123134FFDD5DA8B69399F1D64D735DDE9E74DD0284D42940891426312F33BED89574EE462A4E0A024609A5A4B162CA
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
00a0 - e9 ba 7e c0 02 aa 0b 9e-c2 b8 bc 5c c1 1b 08 bb ..~........\....
Start Time: 1727107230
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
---
DONE
