Novell SENTINEL 6.1 SP2 - REFERENCE GUIDE 02-2010 Reference Manual page 56

7 Edit the configuration.xml file on all system with Sentinel Control Center and add the
following attribute to the "ssl" element of the "proxied_client" and "proxied_trusted_client"
strategies:
usecacerts="true"
For example:
<strategy active="yes" id="proxied_client"
location="com.esecurity.common.communication.strategy.proxystrategy.Proxi
edClientStrategyFactory">
<transport type="ssl">
<ssl host="hostname" keystore="Path of .proxyClientKeystore" port="10013"
usecacerts="true"/>
</transport>
</strategy>
<strategy active="yes" id="proxied_trusted_client"
location="com.esecurity.common.communication.strategy.proxystrategy.Proxi
edClientStrategyFactory">
<transport type="ssl">
<ssl host="hostname" keystore="Path of .proxyClientKeystore" port="10014"
usecacerts="true"/>
</transport>
</strategy>
NOTE: The default property of
usecacerts
8 Import the
$ESEC_HOME/jre/bin/keytool -import -trustcacerts -alias <keyEntry alias> -
keystore $ESEC_HOME/config/.proxyServerKeystore -file <cer_filename.cer>
This will replace the self-signed certificate installed with Sentinel.
9 Restart Sentinel Server.
Novell also recommends that you change the keystore and keyEntry passwords after replacing the
certificate.
Changing default keystore and keyEntry passwords
By default, the passwords used for keystore and the keyEntry are both set to star1111. It is a good
practice to change these to something new.
NOTE: DAS_Proxy requires that the keystore and keyEntry passwords to be identical.
To change the keystore and the keyEntry password:
1 Execute the following command in the console to change the keystore password:
$ESEC_HOME/jre/bin/keytool -storepasswd -keystore $ESEC_HOME/config/
.proxyServerKeystore
2 Enter the old keystore password (star1111 by default) and a new keystore password. The
following example depicts this:
Enter keystore password: <old_pass>
New keystore password: <new_pass>
Re-enter new keystore password: <new_pass>
56 Sentinel 6.1 Reference Guide
usecacerts
to true.
file into keystore file by executing the following command:
.cer
is false. You must change the property of