Maintaining certificates on Microsoft Windows

BMC does not recommend editing the Windows registry unless you have experience working with the registry and you back up the registry before proceeding.

For example, on Microsoft Windows platforms, in the password Registry key, change

a877b993b0b40c558176bbb07efc54da43505b61b5d07d9d

to

e2447186b2854c59258c5061f04ef1f1a72ed785e8819854

for Control-M/EM:

"\HKEY_LOCAL_MACHINE\SOFTWARE\Bmc Software\CONTROL-M/Server\CONTROL-M/EM\SecurityPolicy\site\{client|server|keystore}"

"password"="a877b993b0b40c558176bbb07efc54da43505b61b5d07d9d,D:
\Program Files\BMC Software\CONTROL-M EM 7.0.00\Ini\local\tree.bin"

for Control-M/Server:

"\HKEY_LOCAL_MACHINE\SOFTWARE\Bmc Software\CONTROL-M/Server\ SecurityPol\-icy\site\{client|server|keystore}

"password"="a877b993b0b40c558176bbb07efc54da43505b61b5d07d9d,D:
\Program Files\BMC Software\CONTROL-M Server\Ctm\DATA\SSL\Cert\tree.bin"

for Control--M/Agent:

"\HKEY_LOCAL_MACHINE\SOFTWARE\Bmc Software\CONTROL-M/Server\ SecurityPol\-icy\site\{client|server|keystore}"

"password"="a877b993b0b40c558176bbb07efc54da43505b61b5d07d9d,D:
\Program Files\BMC Software\CONTROL-M Agent\Agent_installation\DATA\SSL
\Cert\tree.bin"

and in the client, server, and common Windows Registry hives:

"\HKEY_LOCAL_MACHINE\SOFTWARE\Bmc Software\CONTROL-M/Server\ SecurityPol\-icy\site\{client|server|keystore}"

For more information, see:

• Security policies
• Maintaining certificates on UNIX

To use your own encrypted password for Control-M/Server for the ctmkey.jks

The password that was used for creating the ctmkey.jks should be encrypted and saved in the following file:

<Control-M Server Home dir/ctm_server/data/SSL/cert/jks.properties>

To encrypt this password, run the change_pass utility as follows:

<Control-M Home dir>/change_pass <Control-M Server Home dir/ctm_server/data/SSL/cert/jks.properties>

The change_pass utility accepts a keytool password, encrypts it and updates the following file:

<Control-M Server Home dir/ctm_server/data/SSL/cert/jks.properties>

To export a key pair

1. Run the sslcmd utility (see sslcmd menu).
2. In the sslcmd Main menu, select 17 Export key pair.
3. Enter the file name for the key pair.
4. Enter the identity for the key pair.
5. Enter the encryption password for the key pair and retype the password for confirmation.
6. Enter and re-type the MAC password.