Configure a CA Certificate for FlexNet Manager for Engineering Applications Admin and Reporting services

1. Prepare the environment
   1. Create a shared folder on the Admin Server:
      mkdir E:\FLEXnet\certs
   2. Share the folder as Certs and provide write access to all users involved in this setup.
2. Generate encryption keys & self-signed certificates
   Run the following steps on both the Admin and Reporting servers:
   1. cd E:\FLEXnet\manager\{server_type}
   2. rm ".\release\platform\bin\keystore"
   3. .\jvm\bin\keytool.exe -keystore ".\release\platform\bin\keystore" -storepass "flexnet" -genkeypair -alias "tomcat" -keyalg RSA -validity 7300 -keypass "flexnet" -dname "CN={Server FQDN},OU=IT,O=test,L=test,S=test,C=test" -ext "SAN=dns:{Server DNS Alias}" -keysize 2048

Replace {server_type} with admin or reporting as appropriate.
Replace {Server FQDN} and {Server DNS Alias} with your server’s actual values.

3. Generate Certificate Signing Requests (CSRs)
   Run the following steps on both servers:
   1. cd E:\FLEXnet\manager\{server_type}
   2. .\jvm\bin\keytool.exe -keystore ".\release\platform\bin\keystore" -certreq -keyalg RSA -alias tomcat -file "\\{Admin Server FQDN}\certs\{server_type}.csr"

If a SAN value is required, add: -ext SAN=dns:test.example.com

4. Get certificates signed by a CA
   Submit the .csr files to your Certificate Authority (CA). You should receive:

1. • Root CA certificate
   • Intermediate CA certificate
   • Signed Server Certificate

5. Import CA-signed certificates
   Run the following steps on both servers:
   1. cd E:\FLEXnet\manager\{server_type}
   2. .\jvm\bin\keytool.exe -keystore ".\release\platform\bin\keystore" -import -trustcacerts -alias "root" -file "\\{Admin Server FQDN}\certs\{server_type}_root_signed.cer"
   3. .\jvm\bin\keytool.exe -keystore ".\release\platform\bin\keystore" -import -trustcacerts -alias "intermediate" -file "\\{Admin Server FQDN}\certs\{server_type}_intermediate_signed.cer"
   4. .\jvm\bin\keytool.exe -keystore ".\release\platform\bin\keystore" -import -trustcacerts -alias "tomcat" -file "\\{Admin Server FQDN}\certs\{server_type}_signed.cer"
6. Export certificates
   Run the following steps on both servers:
   1. cd E:\FLEXnet\manager\{server_type}
   2. .\jvm\bin\keytool.exe -keystore ".\release\platform\bin\keystore" -storepass "flexnet" -alias "root" -exportcert -file "\\{Admin Server FQDN}\certs\{server_type})root.cer"
   3. .\jvm\bin\keytool.exe -keystore ".\release\platform\bin\keystore" -storepass "flexnet" -alias "intermediate" -exportcert -file "\\{Admin Server FQDN}\certs\{server_type}_intermediate.cer"
   4. .\jvm\bin\keytool.exe -keystore ".\release\platform\bin\keystore" -storepass "flexnet" -alias "tomcat" -exportcert -file "\\{Admin Server FQDN}\certs\{server_type}.cer"
7. Import certificates into truststores
   Run the following steps on both servers:
   1. cd E:\FLEXnet\manager\{server_type}
   2. .\jvm\bin\keytool.exe -keystore ".\jvm\lib\security\cacerts" -storepass "changeit" -import -alias {peer_server} -file "\\{Admin Server FQDN}\certs\{peer_server}.cer" -trustcacerts -noprompt
   3. .\jvm\bin\keytool.exe -keystore ".\jvm\lib\security\cacerts" -storepass "changeit" -import -alias {peer_server}_root -file "\\{Admin Server FQDN}\certs\{peer_server}_root.cer" -trustcacerts -noprompt
   4. .\jvm\bin\keytool.exe -keystore ".\jvm\lib\security\cacerts" -storepass "changeit" -import -alias {peer_server}_intermediate -file "\\{Admin Server FQDN}\certs\{peer_server}_intermediate.cer" -trustcacerts -noprompt

Replace {peer_server} with admin on the Reporting Server and reporting on the Admin Server.

5. Import Cognos root certificate (Optional: if Cognos is used)
   Run this command on both servers:
   .\jvm\bin\keytool.exe -keystore ".\jvm\lib\security\cacerts" -storepass "changeit" -import -alias cognos_root -file "\\{Admin Server FQDN}\certs\cognos_root.cer" -trustcacerts -noprompt