Certificate Store Integration with MicroStrategy Library

Certificate Store primarily serves as a data source exposed via a REST API. This data source provides the data for display in the Certificates section of the Workstation window.

Integration with MicroStrategy Library

To integrate Certificate Store with MicroStrategy Library, you can select Certificate Store when installing Library. This will ensure that the Certificate Store REST API appears to be a part of the entire MicroStrategy REST API suite.

So while it looks as if the Certificate Store REST API (/api/serviceCertificates) is served from the same web endpoint as the other APIs, in reality requests made to the /api/serviceCertificates endpoint are actually redirected to the Certificate Store Server. This redirection is accomplished by a proxy servlet configured in the Library web.xml file.

The servlet is configured by the installer and takes all URLs that match the url-pattern property, and redirects them to the URL specified in the targetUri property. If you are altering these settings to add or remove SSL support, you must update the targetUri property so that it specifies either "http" or "https".

If self-signed certificates are used then the trustAllCertificates and disableHostnameVerification properties must be set to true. If a user switches from self-signed to CA-assigned certificates, they should set both certificates to false to receive the benefits of the CA-assigned cert.

<servlet>
<servlet-name>CertificateManagerService</servlet-name>
<servlet-class>org.mitre.dsmiley.httpproxy.ProxyServlet</servlet-class>
<init-param>
<param-name>targetUri</param-name>
<param-value>http://localhost:5050/api/serviceCertificates</param-value>
</init-param>
<init-param>
<param-name>log</param-name>
<param-value>true</param-value>
</init-param>
<!-- SSL SUPPORT START - The following group of parameters are only relevant when the targetUri above uses the "https" protocol. -->
<init-param>
<param-name>truststorePath</param-name>
<param-value>{PATH_TO_TRUSTSTORE}</param-value>
</init-param>
<init-param>
<param-name>truststoreType</param-name>
<param-value>PKCS12</param-value>
</init-param>
<init-param>
<param-name>truststorePassword</param-name>
<param-value>{TRUSTSTORE_PASSWORD_OR_BLANK_IF_NONE}</param-value>
</init-param>
<init-param>
<param-name>keyPassword</param-name>
<param-value>{KEY_PASSWORD_OR_BLANK_IF_NONE}</param-value>
</init-param>
<!-- DEVELOPMENT - START - The following parameters are for development/debugging use only and should not be set to TRUE in production systems. -->
<init-param>
<param-name>trustAllCertificates</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>disableHostnameVerification</param-name>
<param-value>false</param-value>
</init-param>
<!-- DEVELOPMENT END -->
<!-- SSL SUPPORT END -->
</servlet>
<servlet-mapping>
<servlet-name>CertificateManagerService</servlet-name>
<url-pattern>/api/serviceCertificates/*</url-pattern>
</servlet-mapping>

Where:

• truststorePath is used to load the truststore which is handled by ServletContext.getResourceAsStream().  

  The path rules for this method can be found in the Oracle documentation. The path must begin with a slash (/) and is interpreted as relative to the current context root or relative to the /META-INF/resources directory of a JAR file inside the web application's /WEB-INF/lib directory. The path separator is a slash (/) on both Unix and Windows.

• truststoreType accepts a variety of keystore/truststore types, for a full list, see the Java SE Documentation. MicroStrategy supports JKS and PKCS12.

Certificate Store Configuration Properties

Settings for the Certificate Store can be changed by editing the application.properties file. All parameters are case sensitive and must be entered correctly for changes to take effect.

The application.properties can be found in:

• Windows: <INSTALL_PATH>\MicroStrategy\Certificate Manager
• Linux: <INSTALL_PATH>/Certificate Manager

This file includes the following properties:

Considerations in Clustered Environments

The Certificate Store process normally listens for REST API requests on localhost:5050. The server is bound to the loopback interface so that only processes on the same machine may make API requests.

In a clustered environment, there is a Certificate Store process on each node. Because Certificate Store builds its data from the services registered with Consul, and Consul contains entries for all nodes, Certificate Store will contain entries for all services in the cluster and not those services on the current node. However, because some services are bound to the loopback address, some certificates will not be retrievable from other nodes in the cluster.

Other Library Considerations

If your Library installation does not have Certificate Store the proxy servlet may still be configured, however the targetUri will not point to a valid endpoint. Users with this configuration will receive a 502 Bad Gateway error (or other 5xx level HTTP errors). To resolve these errors, you can install Certificate Store or remove the proxy servlet configuration from the Library web.xml file.