Every file created or changed, and why

The full inventory, so the change is auditable and reversible. Nothing here is inferred: each entry was written and then read back.

On the workstation (host)

Path	Action	Why
keycloak-sso/scripts/gen-tc-cert.sh	created	Reproducible certificate generator. Committed (d06d050) so the cert is not a one-off command in someone's shell history.
keycloak-sso/certs/tc-server.crt	created	The Teamcenter leaf certificate. Gitignored.
keycloak-sso/certs/tc-server.key	created	Its private key. Gitignored, and it leaves the host only to go into the guest.
keycloak-sso/.gitignore	modified	Added certs/tc-server.crt. The existing rules covered *.key and server.crt but not the new leaf name.
tc-mcp/profiles.json	modified	vm2606 and vm2606dba hosts repointed to https://siemensdc. This is the file the MCP server actually reads.
tc-mcp/profiles.json.bak-2026-08-15-pre-ssl443	backup	Reversal point.
~/.xcelerator/tc-profiles.json	modified	A stale duplicate: mcp_server.py:45 resolves the profile path to the repo copy, so nothing loads this one. Updated to match and flagged in-file rather than left to drift.
Host LocalMachine\Root	CA imported	The client-side trust that unblocked host browsers, curl and tc-mcp at once. See trust stores.

On the guest, Active Workspace

Path	Action	Why
...\microservices\certs\tc-server.crt	created	The certificate the gateway serves. PEM, no BOM.
...\microservices\certs\tc-server.key	created	Its key. That certs\ directory already existed and was empty: TLS was scaffolded and unconfigured.
...\microservices\gateway\config.json	modified	port 3000 to 443, keyPath and certPath set, forceSecureAttributeOnCookies to true.
...\gateway\config.json.bak-2026-08-15-pre-ssl443	backup	The pre-TLS state. Restoring it reverts to plain HTTP on 3000.
Firewall rule TC2606 AWC HTTPS 443 (Hyper-V host only)	created	Inbound 443, scoped to the Hyper-V host, matching the existing rules' scope.

On the guest, Deployment Center

Path	Action	Why
...\DC\webserver\config\dc-keystore.p12	created	Jetty needs a keystore, not a PEM pair. Holds cert, key and CA chain, alias dcserver.
...\DC\webserver\config\dc-truststore.p12	created	Our CA is not publicly trusted, and the DC guide says to supply a truststore in that case.
...\DC\webserver\config\xcelerator-ca.crt	created	The CA in PEM, used as the source for building the truststore with keytool.
...\DC\webserver\dcserver.properties	modified	DC_HTTPS_ENABLED=true plus the keystore, truststore and DC_CERTIFICATE_TYPE=PKCS12 values.
...\dcserver.properties.bak-2026-08-15-pre-ssl	backup	Reversal point.
...\jetty_base\start.d\ssl.ini	created, then extended	Created by the vendor createJettyBase.bat, which leaves every property commented out. The appended block is what actually enables TLS.
...\jetty_base\start.d\https.ini	created	Added by the same vendor script.
...\jetty_base\start.d\http.ini	renamed to http.ini.disabled-2026-08-15	HTTPS disables HTTP for DC. Renamed rather than deleted so it is reversible; Jetty reads only *.ini.
...\jetty_base\start.d.bak-2026-08-15-pre-ssl\	backup	The whole pre-change module directory.

Snapshot

A Hyper-V checkpoint named pre-ssl-443-gateway-tls 2026-08-15 was taken before any edit. It is an offline checkpoint (the VM happened to be stopped at that moment), which is the safer kind: an offline checkpoint carries no saved memory image, so restoring it does not demand the VM's full startup RAM as one atomic reservation.

Pre-existing, but load-bearing

Not created by this work, and worth knowing before changing anything:

Path	Why it matters
keycloak-sso/certs/ca.crt and ca.key	The root of everything. Losing ca.key means re-trusting a new CA in all four stores.
Guest C:\apps\jdk-21.0.11.10\lib\security\cacerts	The JDK truststore holding xcelerator-local-ca.
...\cacerts.bak-2026-08-15-pre-xcelerator-ca	The pre-CA truststore. Keep it: it is the negative control that proves JVM trust is real.

How to reverse the whole thing

1. Restore config.json from its .bak-2026-08-15-pre-ssl443, then restart Teamcenter Process Manager (not WebTier).
2. Restore dcserver.properties and start.d from their .bak-2026-08-15-pre-ssl copies, rename http.ini.disabled-2026-08-15 back, then restart DC_Service (not DC_RepoService).
3. Repoint tc-mcp/profiles.json back to http://192.168.222.100:3000.
4. Or restore the checkpoint, which undoes every guest-side change at once.

Removing the CA from the host trust store is optional and independent: it affects only what the host trusts, not what the guest serves.