First move PEM file to sas serve
1. Update the Key and Certificate That Are Used by SAS Web Server
To update the key and certificate, follow these steps:
a. Stop SAS Web Server and all SAS Web Application Server instances.
b. Move and update the certificate and key files.
First Make a backup of the files in /opt/sasinside/config/midtier/Lev1/Web/WebServer/ssl
cd /opt/sasinside/config/midtier/Lev1/Web/WebServer/ssl
mkdir CERTS-2023
cp -p * CERTS-2023/.
c. Put the certificate file and key file in the ssl directory and rename the certificate and
key files to the default names of the files that were backed up.
cp -p /opt/CERTS /opt/sasinside/config/midtier/Lev1/Web/WebServer/ssl/.
d. Change the default permissions of the key file to be read-only for the user that SAS Web Server
is configured to run as (the file permissions should be set to -r--------).
chmod 400 busas.binghamton.edu.key busas.binghamton.edu.crt
e. Edit the /opt/sasinside/config/midtier/Lev1/Web/WebServer/conf/extra file.
Locate the uncommented lines for the certificate file and key file and verify that the correct file names are specified:
Our directory is /opt/sasinside/config/midtier/Lev1/Web/WebServer/conf/extra
SSLCertificateFile "ssl/myhost.crt"
SSLCertificateKeyFile "ssl/myhost.key"
SSLCertificateChainFile "ssl/myhost.crt
We have this commented out:
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convenience.
#SSLCertificateChainFile "ssl/busas.binghamton.edu-ca.crt"
(Optional) To verify that security has been configured correctly, start SAS Web Server. Then, access the secure SAS Web Server from your web browser.
2. For SAS 9.4M3 and later, use the SAS Deployment Manager to import your CA certificates into the trusted CA bundle onto each machine in the deployment. You need to specify the location of your self-signed or site-signed CA certificate to the SAS Deployment Manager, and it updates the SAS Private JRE for you. For more information, see “Manage Certificates in the Trusted CA Bundle Using the SAS Deployment Manager” in Encryption in SAS.
Start each SAS Web Application Server instance.
/opt/sasinside/SAS.Services start
========================================================================
3. Update the certificate and key used by SAS Environment Manager (Unix):
This SAS Note provides instructions for how to manually configure and/or renew certificates
for SAS Environment Manager to enable HTTPS on Linux or UNIX systems.
NOTE: These instructions need to be performed on the machine containing the SAS Environment Manager service.
1. Make sure that you have the following files available before proceeding with the rest of the steps:
-- your updated server certificate
-- the private key corresponding to your updated server certificate
-- your intermediate certificate(s)
-- your root certificate
NOTE: Depending on where the SAS Environment Manager service resides,
the certificate and key files that need to be used will differ:
If the SAS Environment Manager service is present on the same machine as a SAS® Web Server service,
you can use the same files as those used for that SAS Web Server.
The above files must satisfy the following requirements from the Obtaining a Signed Certificate for
SAS Web Server section of the SAS® 9.4 Intelligence Platform: Security Administration Guide documentation:
The key file should NOT be protected by a passphrase.
Both the certificate and key files should NOT be encrypted,
but instead should be in 64-bit Privacy-enhanced Electronic Mail (PEM) format.
NOTE: The resulting certificate files will likely end with a .crt extension.
They might end in a .cer extension. They do not have to end in a .pem extension.
You should also explicitly check that the server certificate and its corresponding private key match.
NOTE: There are various OpenSSL command variants for accomplishing this task.
One such set of commands can be found on the SSL Shopper's Certificate Key Matcher page.
SAS Technical Support does not assist with obtaining or generating certificates/keys.
The ownership/responsibility of obtaining the correct certificates in the valid format lies with the customer.
2. If the SAS Environment Manager service is present on the same machine as a SAS Web Server service,
place the files from the previous step in the SAS-configuration-directory/LevN/Web/WebServer/ssl directory.
3. Along with the files from step 1, the Networking or Information Security team at your organization might
have provided a certificate chain file that itself contains the root certificate, your intermediate certificate(s),
and your server certificate.
Assuming that this is the case, if the SAS Web Server is present on the same machine(s)
where the SAS Environment Manager service is present, place the chain file in the
SAS-configuration-directory/LevN/Web/WebServer/ssl directory.
Otherwise, perform the following steps to create the certificate chain file:
a. In a text editor, create a new file.
b. In a separate text editor instance/window/tab, open the root certificate.
c. Copy the contents of the root certificate into the new file.
d. Close the root certificate text editor instance, keeping the new file where you pasted its contents open.
e. In a separate text editor instance/window/tab, open the first intermediate certificate.
f. Copy the contents of the intermediate certificate directly below the contents of the root certificate.
g. Close the intermediate certificate text editor instance, keeping the new file where you pasted its contents open.
h. Repeat the previous three steps for each intermediate certificate that you have.
i. In a separate text editor instance/window/tab, open the server certificate.
j. Copy the contents of the server certificate directly below the contents of the last intermediate certificate.
k. Close the server certificate text editor instance, keeping the new file where you pasted its contents open.
l. Save the new file with a .pem extension on the machine where the SAS Web Application Server instances are present. If a SAS Web Server is present on the same machine, place it in the SAS-configuration-directory/LevN/Web/WebServer/ssl directory.
At this point, the contents of the saved file should resemble the following:
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
…
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
NOTE: If SAS Environment Manager is already configured for HTTPS and you are simply attempting to update the certificates it is using, skip to Step #7. Otherwise, if you are configuring SAS Environment Manager for HTTPS, proceed with the immediate next step, #4.
NOTE: Change only the URLS where the port is 7080, because those files contain SASLogon URLs, which should NOT be changed.
7. Set the initial environment variables for OpenSSL by executing the following commands:
export OPENSSL_HOME=/SASWebServer/9.4/httpd-
export OPENSSL_CONF=$OPENSSL_HOME/ssl/openssl.cnf
export PATH=$OPENSSL_HOME/bin:$PATH
For us, this is:
export OPENSSL_HOME=/opt/sasinside/sashome/SASWebServer/9.4/httpd-2.4.43
export OPENSSL_CONF=$OPENSSL_HOME/ssl/openssl.cnf
export PATH=$OPENSSL_HOME/bin:$PATH
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/sasinside/sashome/SASWebServer/9.4/httpd-2.4.43/lib
8. Set the OpenSSL library path environment variable by executing the appropriate command based on your specific UNIX operating system. Note that, for this reason, only one of the following commands should be executed for this step:
Linux or Solaris:
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/SASWebServer/9.4/httpd-/lib
In above stmt for #7
9. Create a hyperic.p12 file that contains the updated certificates by executing command(s) similar to the following:
/SASWebServer/9.4/httpd-version/bin/openssl pkcs12 -export -chain -inkey -in -name hq -CAfile -out hyperic.p12
*******We are going to run this in /opt/sasinside/config/midtier/Lev1/Web/SASEnvironmentManager/server-5.8.0-EE/conf
*******need to make a backup first of hyperic file
cp /opt/sasinside/config/Lev1/Web/SASEnvironmentManager/server-5.8.0-EE/conf/hyperic.keystore /opt/sasinside/config /Lev1/Web/SASEnvironmentManager/server-5.8.0-EE/conf/hyperic.keystore.bkup.Oct2023
Our command is
/opt/sasinside/sashome/SASWebServer/9.4/httpd-2.4.43/bin/openssl pkcs12 -export -chain -inkey /opt/sasinside/config/midtier/Lev1/Web/WebServer/ssl/busas.binghamton.edu.key -in /opt/sasinside/config/midtier/Lev1/Web/WebServer/ssl/busas.binghamton.edu.crt -name hq -CAfile /opt/sasinside/config/midtier/Lev1/Web/WebServer/ssl/bu.binghamton.pem -out hyperic.p12
NOTE: This command creates the hyperic.p12 file in the directory where you ran the openssl command.
NOTE: When prompted, enter "hyperic" for the password.
10. Run the following keytool command to create the new hyperic.keystore file from the hyperic.p12 file created in the previous step:
/SASPrivateJavaRuntimeEnvironment/9.4/jre/bin/keytool -importkeystore -srcstoretype PKCS12 -srckeystore -destkeystore hyperic.keystore -srcstorepass hyperic -deststorepass hyperic -destkeypass hyperic -alias hq
NOTE: This command creates the hyperic.keystore file in the directory where you ran the keytool command.
11. Once the new hyperic.keystore file has been created, take a backup of your current hyperic.keystore in the SAS-configuration-directory/LevN/Web/SASEnvironmentManager/server--EE/conf directory. Then, replace the current hyperic.keystore file with the new one created in the previous step.
/opt/sasinside/sashome/SASPrivateJavaRuntimeEnvironment/9.4/jre/bin/keytool -importkeystore -srcstoretype PKCS12 -srckeystore /opt/sasinside/config/midtier/Lev1/Web/SASEnvironmentManager/server-5.8.0-EE/conf/hyperic.p12 -destkeystore hyperic.keystore -srcstorepass hyperic -deststorepass hyperic -destkeypass hyperic -alias hq
12. Stop the SAS Environment Manager Agent services, SAS Environment Manager, SAS Web Application Server instances, and the SAS Web Server (if they have not been stopped already).
NOTE: For information about stopping/starting SAS services, see the Operating Your Servers documentation section.
13. On the machine where the SAS Web Infrastructure Platform Data Server is installed (typically your primary SAS compute-tier machine), log on as the SAS installer user and then issue the following psql commands:
POSTGRES_HOME=/SASWebInfrastructurePlatformDataServer/9.4
export PATH=${POSTGRES_HOME}/bin:$PATH
for us
POSTGRES_HOME=/opt/sasinside/sashome/SASWebInfrastructurePlatformDataServer/9.4
export PATH=${POSTGRES_HOME}/bin:$PATH
14. Temporarily add the Postgres library location to the library path environment variable by executing the appropriate command based on your specific UNIX operating system. Note that, for this reason, only one of the following commands should be executed for this step:
Linux or Solaris:
export LD_LIBRARY_PATH=${POSTGRES_HOME}/lib:$LD_LIBRARY_PATH
15. Delete the database entry for the previous keystore by executing the following command:
psql -h localhost -p 9432 -U EVManager -c "delete from public.eam_keystore;"
NOTE: If this command executes successfully, skip to step 19. Otherwise, proceed with the next step.
16. Access the EVManager database by executing the following command:
/SASWebInfrastructurePlatformDataServer/9.4/bin/psql -h -p -U -d EVManager
For us:
##
## STEP 06
##
/opt/sasinside/sashome/SASWebInfrastructurePlatformDataServer/9.4/bin/psql -h busas.binghamton.edu -p 9432 -U dbmsowner -d EVManager
### EVManager/ use dbmsowner pw
/opt/sasinside/sashome/SASWebInfrastructurePlatformDataServer/9.4/bin/psql -h busas.binghamton.edu -p 9432 -U dbmsowner -d EVManager -c "select * from public.eam_keystore;"
##
## STEP 07
##
### EVManager/ use dbmsowner pw
/opt/sasinside/sashome/SASWebInfrastructurePlatformDataServer/9.4/bin/psql -h busas.binghamton.edu -p 9432 -U dbmsowner -d EVManager -c "delete from eam_keystore;"
Quit the psql console by typing \q and pressing Enter.\
----------------------------------------------------------------------------------------
17. Delete the database entry for the previous keystore by executing the following command:
delete from eam_keystore;
18 Quit the psql console by typing \q and pressing Enter.
19. Delete the contents of the SAS-configuration-directory/LevN/Web/SASEnvironmentManager/agent--EE/data directory on all SAS server machines.
20. Start the SAS Web Server, SAS Web Application Server instance(s), SAS Environment Manager, and SAS Environment Manager Agent services.
NOTE: SAS Web Application Servers (especially SASServer1_1) can take a long time to load. Do not proceed until you see the following message at the bottom of your SAS-configuration-directory/Lev/Web/WebAppServer/SASServer1_1/logs/server.log file:
"Server startup in ... ms."
21. Log on to the SAS Environment Manager Web Console (using https://:7443, assuming that the default port is being used).