Configure symmetric keys

For improved security, you can move the FMS encryption key from a clear text file to an encrypted, password-protected keystore file. Use the keygen script to import the key file into a keystore and the passwordtool script to generate encrypted passwords based on a clear text password. The keytool used in this example is from Java JDK 1.5. Procedure Create the signing keystore to hold the FMS encryption key. Determine the key alias under which you want to store the FMS key. In this example, the key alias is ent123.tickets. Determine the keystore name. In this example, the keystore name is trusted.jceks. Determine the passwords used for the keystore. In this example, the password is trusted.jceks.lp7qZF.password. Determine the password used for the FMS encryption key. In this example, the password is ent123.tickets.z3nYsY.password. Use the keygen script to create the keystore and key. In this example, a new key is created. Alternatively, you can import an existing key. Copy > keygen 128 5706c8eebd67eb754544ab720f08d95b Use the keygen script to import the key file into the keystore using the following form: Copy > keygen -importseckey -keystore keystorefilename -storepass keystore.password -alias alias [-overwrite] [-keypass key.password] [[-k keyfile] | [-key asciihexkey]] keystore filename must end in .jceks (SecretKeys can only be stored in jceks keystores) [-keypass key.password] is optional (defaults to storepass value) [-overwrite] is optional, by default will not allow overwriting an existing key Either [-k keyfile] or [-key asciihexkey] are required For example: Copy > keygen -importseckey -keystore trusted.jceks -storepass trusted.jceks.lp7qZF.password -alias ent123.tickets -keypass ent123.tickets.z3nYsY.password -key 5706c8eebd67eb754544ab720f08d95b No messages are displayed when the script succeeds. Use the keytool to list the contents of the keystore. For example: Copy > keytool -storetype jceks -keystore trusted.jceks -storepass trusted.jceks.lp7qZF.password -list -v Keystore type: jceks Keystore provider: SunJCE Your keystore contains 2 entries Alias name: ent123.tickets Creation date: Jul 10, 2023 Entry type: keyEntry ******************************************* ******************************************* Alias name: ent123.trustedadmin Creation date: Jul 10, 2023 Entry type: keyEntry Certificate chain length: 1 Certificate[1]: Owner: CN=FMS trusted admin policy site ent123, OU=org unit, O=org, L=c, ST=st, C=cc Issuer: CN=FMS trusted admin policy site ent123, OU=org unit, O=org, L=c, ST=st, C=cc Serial number: 4a578037 Valid from: Mon Jul 10 13:53:59 EDT 2023 until: Mon Nov 24 12:53:59 EST 2050 Certificate fingerprints: MD5: 66:6F:67:55:09:CA:04:69:52:76:C8:49:30:30:75:F0 SHA1: E4:74:66:DD:54:C2:0D:4B:D2:AD:74:EA:65:69:89:C7:0F:16:71:49 ******************************************* ******************************************* Create and/or modify the FSC property files. Encrypt the keystore and key/alias password values using the passwordtool script. For example: Copy > passwordtool -encrypt trusted.jceks.lp7qZF.password fcLxB/oeZ+IeNnP/vofAqFpDqmJdSyaU0y+EHU0ffRc= > passwordtool -encrypt ent123.tickets.z3nYsY.password vhTHTCLYz9BxE8TN4MpLFNIFkIrDMCfU7mh+pYbqfcw= Add the following properties to the fsc.fscid.properties file: Copy # signing keystore file and password com.teamcenter.fms.signing.keystore.file=trusted.jceks com.teamcenter.fms.signing.keystore.epassword=fcLxB/oeZ+IeNnP/vofAqFpDqmJdSyaU0y+EHU0ffRc= # key password(s) property name form: com.teamcenter.fms.signing..epassword com.teamcenter.fms.signing.ent123.tickets.epassword=vhTHTCLYz9BxE8TN4MpLFNIFkIrDMCfU7mh+pYbqfcw= In the fmsmaster configuration file, add the following elements under fscadminpolicies and before fscdefaults. For example: Copy ... ... ... The system uses the keystorealias attribute to retrieve the password from the properties file and access the key in the keystore. Confirm the accuracy of the configuration by reloading the fmsmaster configuration file. The FSC cannot reload the configuration if the ticketing aliases or keys are unavailable for any reason. For example: Copy > fscadmin -s http://cii6w223:4544 ./config/reload Initial configuration hash: efed77c0315fc5f9bf289cb4db0b164f Configuration reload successful. Final configuration hash: ac718b9778cbcfebcabea266b3c1155a Restart the FSC. The ticketing keys are applied. Create and/or modify the fscadmin property file by adding the following properties. Use the same encrypted passwords as generated previously. For example: Copy # signing keystore file and password com.teamcenter.fms.signing.keystore.file=trusted.jceks com.teamcenter.fms.signing.keystore.epassword=fcLxB/oeZ+IeNnP/vofAqFpDqmJdSyaU0y+EHU0ffRc= # default fms ticket signing alias com.teamcenter.fms.signing.tickets.alias=ent123.tickets # key password(s) property name form: com.teamcenter.fms.signing..epassword com.teamcenter.fms.signing.ent123.tickets.epassword=vhTHTCLYz9BxE8TN4MpLFNIFkIrDMCfU7mh+pYbqfcw= Use the fscadmin command to confirm that the keys/certificates are available. For example: Copy > fscadmin -s http://cii6w223:4544 ./keystoreinfo Keystore info: # of private keys: 1, aliases: [ent123.trustedadmin] # of secret keys: 1, aliases: [ent123.tickets] # of certificates: 1, aliases: [ent123.trustedadmin] Check in the FSC log files. For example: Copy ... INFO - 2023/07/10-18:38:55,500 UTC - cii6w223 - Keystore info: # of private keys: 1, aliases: [ent123.trustedadmin] # of secret keys: 1, aliases: [ent123.tickets] # of certificates: 1, aliases: [ent123.trustedadmin] ... Any keys that cannot be loaded are listed in the FSC log files. For example: Copy java.security.UnrecoverableEntryException at java.security.KeyStoreSpi.engineGetEntry(KeyStoreSpi.java:455) at java.security.KeyStore.getEntry(KeyStore.java:1218) ... Verify that the key has been moved or configured correctly by running the FSC. If the FSC runs normally, reports that the secret key is available, and the fscadmin command works, then the move is successful. If the configuration is incorrect, either the FSC does not reload, or the secret key is not listed, or the fscadmin command gives the following error: Copy > fscadmin -s http://cii6w223:4544 ./keystoreinfo Error, server returned status code: 400, status message: TICKET_VALIDATION_FAIL_0 If a previous plain text key configuration exists, delete the previous clear text key file after verifying the fscadmin command and FSC are successfully using the keystore. After confirming the encryption key has been successfully moved to the keystore file, manage it by: Storing a backup of your keystores and passwords in a safe location. Creating a new encryption key and deploying new keystores if you suspect the encryption key is compromised. Update the Teamcenter database with the new key Once you have generated the new key, you must update the Teamcenter database with the key so that tickets generated from Teamcenter are signed with the new key before being sent to the FSC which then validates using the new key. Use the install_encryptionkeys utility with the -f=modify option to update the database. For example: Copy install_encryptionkeys -u=Tc-admin-user -p=password -g=group -f=modify When prompted, supply the new key.