LDAP SSL Configuration

The following procedures describe how to configure SSL in an LDAP environment:

BMC does not enforce the strength of the certificate cryptography algorithm used for this connection. BMC recommends that you use a strong certificate cryptography algorithm.

Configuring SSL with LDAP or Active Directory Servers

This procedure describes how to configure SSL/TLS communication between Control-M/EM and LDAP or Active Directory servers. If you replaced the certificate on your LDAP Server or your Active Directory server, you must complete this procedure.

Begin

  1. Obtain the root CA certificate that signed your LDAP server or your Active Directory server certificate from the directory server.

    Each LDAP server vendor has a different certificate export process. Contact to your LDAP server administrator to determine how obtain the correct certificate. For an example on how to obtain a certificate from the Windows Active Directory, see Obtaining a Certificate File from the Windows Active Directory Server.

  2. Do the following:

    • UNIX:

      1. Open the <Control-M/EM_home>/etc/ldap.conf file in a text editor and locate the TLS_CACERT parameter and its pathnameClosed The fully specified name of a computer file, including the position of the file in the file system directory structure. value.

        TLS_CACERT /home/smartool/ctm_em/etc/keystore/em_ldap_ssl.pem

      2. Replace the TLS_CACERT parameter value with the root CA certificate pathname, and then save and close the file.

      3. (Optional) Configure ciphers, as described in Limiting Cipher Suites for LDAP Connections.

    • Windows:

      1. Press Win + R.

        The Windows Run app appears.

      2. In the Open field, type mmc and press Enter.

        Microsoft Management Console (MMC) utility opens.

      3. From the MMC utility, install the root CA certificate on your host, as described in the Microsoft documentation.

      4. Limit the LDAP server SSL connections with specific ciphers, as described in Microsoft documentation.

  3. Run the following commands to recycle all Control-M/EM components:
    • stop_all
    • start_all

  4. Define an LDAP server that can communicate with Control-M/EM in SSL mode, as described in Configuring System Settings.

    If you do not apply all of the above steps, LDAP authentication in SSL mode fails.

  5. Run the following command to test the Control-M/EM to the LDAP server connection:

    • UNIX: <Control-M/EM_Home>/bin/openssl s_client -connect <LDAP_Server_Hostname>:<Port_Number> -CAfile <Control-M/EM_Home>/etc/keystore/em_ldap_ssl.pem

      (UNIX only) You must run this script in the Control-M/EM shell, such as em tcsh.

    • Windows: <Control-M/EM_Home>\bin\openssl s_client -connect <LDAP_Server_Hostname>:<Port_Number> -CAfile <Control-M/EM_Home>/etc/keystore/em_ldap_ssl.pem

    where the default LDAP server Port_Number is 636.

  6. (High Availability and Control-M/EM Distributed instances only) Save the file to the same location on every host.

Limiting Cipher Suites for LDAP Connections

This procedure describes how to limit the cipher suites that Control-M/EM on UNIX can use when it connects to an LDAP server. A cipher suite, such as ECDHE-RSA-AES256-GCM-SHA384, is a named set of cryptographic algorithms that the client and server agree on during the TLS handshake and then use to communicate securely.

Begin

  1. Run the following command to see the supported cipher suites:

    <Control-M/EM_Home>/bin/openssl ciphers -V TLSv1.2

    A list of supported cipher suites appears.

    You can also filter the ciphers according to a specific protocol by sending the protocol name as a parameter to this openssl command.

  2. Limit the ciphers used by this SSL connection, by adding a parameter named TLS_CIPHER_SUITE to the <Control-M/EM Home>/etc/ldap.conf file. You can assign the TLS_CIPHER_SUITE parameter value to include or exclude one or more ciphers with the following syntax:

    • :: Includes a cipher.

    • :!: Excludes a cipher.

    • +: Moves the cipher priority to the end of the list.

    This following value includes all TLSv1.2 ciphers, with the RSA ciphers at the bottom of the list, and excludes all export and null ciphers.

    TLSv1.2+RSA:!EXPORT:!NULL

Obtaining a Certificate File from the Windows Active Directory Server

This procedure describes how to obtain a certificate file from the Windows Active Directory server.

Begin

  1. Navigate to Programs > Administrative Tools > Certification Authority to open the Certification Authority application.

  2. Right-click Certification Authority and select Properties.

  3. Click View Certificate to view the certificate page.

  4. In the Details tab, click Copy to file to start the Certificate Export Wizard.

  5. On the Export File Format page, select the Base-64 Encoded X.509 (*.cer) format and click Next.

  6. Type a filename, with a *.cer extension, that includes the Active Directory server name.

  7. Complete the remaining Certificate Export Wizard steps to create an exported CA certificate for the Active Directory server.

  8. Do the following to convert the certificate from *.cer to *.pem format:

    1. Copy the exported Active Directory server certificate file to a host where the Active Directory client runs.

    2. Log in to the host where you copied the certificate and run the following command:

      <Control-M/EM_Home>\bin\openssl x509 -in <AD_Certificate_Filename> -out em_ldap_ssl.pem

      where the <AD_Certificate_Filename> argument is the converted certificate filename.