1.Update Certs


Moved new certs to ssl

Update the Key and Certificate That Are Used by SAS Web Server 
1.	Stop SAS Web Server and all SAS Web Application Server instances.
2.	DONE Move and update the certificate and key files.
a.	Make a backup of the files in the SAS-configuration-directory\Levn\Web\WebServer\ssl directory.
b.	Put the certificate file and key file in the ssl directory and rename the certificate and key files 
        to the default names of the files that were backed up.
By default, the files are named after the fully qualified domain name of the host machine.

c.	Change the default permissions of the key file to be read-only for the user that SAS Web Server is configured to run as (the file permissions should be set to -r--------).

3.	(Optional) To verify that security has been configured correctly, start SAS Web Server. Then, access the secure SAS Web Server from your web browser.

4.	For SAS 9.4M3 and later, use the SAS Deployment Manager to import your CA certificates into the trusted CA bundle onto each machine in the deployment. You need to specify the location of your self-signed or site-signed CA certificate to the SAS Deployment Manager, and it updates the SAS Private JRE for you. For more information, see “Manage Certificates in the Trusted CA Bundle Using the SAS Deployment Manager” in Encryption in SAS.

5.	Start each SAS Web Application Server instance.

 
 
Update the certificate and key used by SAS Environment Manager (Unix):

 
2.	If the SAS Environment Manager service is present on the same machine as a SAS Web Server service, 
        place the files from the previous step in the <SAS_CONFIG>/Lev#/Web/WebServer/ssl directory.
 

 
Assuming that this is the case, if the SAS Web Server is present on the same machine(s) where the 
SAS Environment Manager service is present, place the chain file in the <SAS_CONFIG>/Lev#/Web/WebServer/ssl directory.
 
 
 
4.	Set environment variables for OpenSSL by executing the following commands:
o	export OPENSSL_HOME=<SAS_HOME_DIR>/SASWebServer/9.4/httpd-<version>
o	export OPENSSL_CONF=$OPENSSL_HOME/ssl/openssl.cnf
o	export PATH=$OPENSSL_HOME/bin:$PATH
o	export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:<SAS_HOME_DIR>/SASWebServer/9.4/httpd-<VERSION>/lib
 

export OPENSSL_HOME=/opt/sasinside/sashome/SASWebServer/9.4/httpd-2.4.43
export OPENSSL_CONF=$OPENSSL_HOME/ssl/openssl.cnf
export PATH=$OPENSSL_HOME/bin:$PATH
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/sasinside/sashome/SASWebServer/9.4/httpd-2.4.43/lib



5.	Create a hyperic.p12 file containing the updated certificates by executing command(s) similar to the one mentioned below:

*******We are going to run this in /opt/sasinside/config/midtier/Lev1/Web/SASEnvironmentManager/server-5.8.0-EE/conf
*******need to make a backup first of hyperic file
mv <SAS_CONFIG>/Lev1/Web/SASEnvironmentManager/server-5.8.0-EE/conf/hyperic.keystore <SAS_CONFIG>/Lev1/Web/SASEnvironmentManager/server-5.8.0-EE/conf/hyperic.keystore.bkup
****************************************************

template -
<SAS_HOME_DIR>/SASWebServer/9.4/httpd-version/bin/openssl        pkcs12 -export -chain -inkey <PATH_TO_SERVER_KEY.key>                                                      -in <PATH_TO_SERVER_CERTIFICATE.crt>                                               -name hq -CAfile <PATH_TO_CERTIFICATE_CHAIN_FILE.pem> -out hyperic.p12

/opt/sasinside/sashome/SASWebServer/9.4/httpd-2.4.43/bin/openssl pkcs12 -export -chain -inkey /opt/sasinside/config/midtier/Lev1/Web/WebServer/ssl/busas.binghamton.edu.key -in /opt/sasinside/config/midtier/Lev1/Web/WebServer/ssl/busas.binghamton.edu.crt  -name hq -CAfile /opt/sasinside/config/midtier/Lev1/Web/WebServer/ssl/bu.binghamton.pem -out hyperic.p12

NOTE: This command will create the hyperic.p12 file in the directory where you ran the openssl command. 
NOTE: When prompted, enter "hyperic" for the password.



 
6.	Run the following keytool command to create the new hyperic.keystore file from the hyperic.p12 
        file created in the previous step:


<SAS_HOME_DIR>/SASPrivateJavaRuntimeEnvironment/9.4/jre/bin/keytool -importkeystore -srcstoretype PKCS12 -srckeystore <PATH_TO_P12_FILE.p12>  -destkeystore hyperic.keystore -srcstorepass hyperic -deststorepass hyperic -destkeypass hyperic -alias hq

/opt/sasinside/sashome/SASPrivateJavaRuntimeEnvironment/9.4/jre/bin/keytool -importkeystore -srcstoretype PKCS12 -srckeystore /opt/sasinside/config/midtier/Lev1/Web/SASEnvironmentManager/server-5.8.0-EE/conf/hyperic.p12 -destkeystore hyperic.keystore -srcstorepass hyperic -deststorepass hyperic -destkeypass hyperic -alias hq

another way
keytool                                                                     -importkeystore -deststorepass hyperic -destkeypass hyperic -destkeystore <SASConfig>/Lev1/Web/SASEnvironmentManager/server-5.8.0-EE/conf/hyperic.keystore  -srckeystore /tmp/hyperic.p12 -srcstoretype PKCS12 -s


rcstorepass hyperic -alias hq


-OLD STUFF---------------------
<SAS_HOME_DIR>/SASPrivateJavaRuntimeEnvironment/9.4/jre/bin/keytool         -importkeystore -srcstoretype PKCS12 -srckeystore <PATH_TO_P12_FILE.p12>                                                                        -destkeystore hyperic.keystore -srcstorepass hyperic -deststorepass hyperic -destkeypass hyperic -alias hq
 
<SAS_HOME_DIR>/SASPrivateJavaRuntimeEnvironment/9.4/jre/bin/keytool         -importkeystore -srcstoretype PKCS12 -srckeystore <PATH_TO_P12_FILE.p12>                                                                        -destkeystore hyperic.keystore -srcstorepass hyperic -deststorepass hyperic -destkeypass hyperic -alias hq
 
/opt/sasinside/sashome/SASPrivateJavaRuntimeEnvironment/9.4/jre/bin/keytool -importkeystore -srcstoretype PKCS12 -srckeystore /opt/sasinside/config/midtier/Lev1/Web/SASEnvironmentManager/server-5.8.0-EE/conf -destkeystore hyperic.keystore -srcstorepass hyperic -deststorepass hyperic -destkeypass hyperic -alias hq
----------------------

NOTE: This command will create the hyperic.keystore file in the directory where you ran the keytool command.
 
7.	Once the new hyperic.keystore file has been created, take a backup of your current hyperic.keystore in 
        the <SAS_CONFIG>/Lev#/Web/SASEnvironmentManager/server-<version>-EE/conf directory. Then, replace the 
        current hyperic.keystore file with the new one created in the previous step.
 
8.	Stop the SAS Environment Manager Agent services, SAS Environment Manager, SAS Web Application Server 
        instances, and the SAS Web Server (if they have not been stopped already).
 
9.	On the machine where the SAS Web Infrastructure Platform Data Server is installed (typically your primary 
        SAS Compute Tier machine), login as the SAS installer user and then issue the following psql commands:

•	POSTGRES_HOME=<SAS_HOME_DIR>/SASWebInfrastructurePlatformDataServer/9.4
•	export PATH=${POSTGRES_HOME}/bin:$PATH
•	export LD_LIBRARY_PATH=${POSTGRES_HOME}/lib:$LD_LIBRARY_PATH