Configuring native FSC client proxy in TcServer

The native implementation uses cURL and OpenSSL and requires a compatible trusted certificate file. This trusted certificate file must be in privacy enhanced mail (PEM) format (which is not the same format as the Java cacerts file). Use one of the following methods to generate a cacerts.pem file that contains the required certificates. Download the trusted certificate file. Generate a trusted certificate file based on the installed Java cacerts file. Generate a trusted certificate file with only the certificates required by your CA. Download the trusted certificate file If your certificate authority (CA) signer is well known, the certificates may be available from the Internet. Siemens Digital Industries Software recommends you contact your internal security team. Procedure Download a current ca-bundle.crt file from the Internet, or get the file from your internal security team. The file must be compatible with cURL and OpenSSL. The file must contain the certificate chain that can validate the FSC certificate. Name the file cacerts.pem and save it in the FSC_HOME directory. Create or modify the FSC_HOME/fsc.clientagent.properties file with the com.teamcenter.fms.curl.cacerts.file property with a value that is the absolute path and file name to the cacerts.pem file. For example: Copy d:\path\to\tc\install\fsc\fsc.clientagent.properties # # com.teamcenter.fms.curl.cacerts.file=d:\path\to\tc\install\fsc\cacerts.pem Be aware that any other host that requires FMS access (for example when running tcserver or a utility such as review_volumes) must also have a local copy of the cacerts.pem file specified in its fsc.clientagent.properties file. Generate a trusted certificate file based on the installed Java cacerts file If your certificate authority (CA) signer certificates are in the Java cacerts file, you can extract them for cURL and OpenSSL. Procedure Extract the trusted certificates in the Java cacerts file in the PEM format that cURL and OpenSSL requires, for example (Windows): Copy rem cd to the dir the java cacerts file is in cd /d %JAVA_HOME%\jre\lib\security rem cleanup leftover files from this script, and any existing cacerts.pem as we are building a new one del /q cacerts.pem cacerts.list export.pem rem get the aliases for all trusted certificates in the cacerts file keytool -keystore cacerts -storepass changeit -list | find "trustedCertEntry" | sort > cacerts.list rem for each alias export the certificate and append to the cacerts.pem file for /f "delims=, tokens=1" %f in (cacerts.list) do keytool -export -rfc -alias %f -keystore cacerts -storepass changeit -file export.pem & echo %f >> cacerts.pem & type export.pem >> cacerts.pem rem cleanup leftover files from this script del /q cacerts.list export.pem rem cacerts.pem contains all the trusted certificates in pem format Save the file in the FSC_HOME directory. Create or modify the FSC_HOME/fsc.clientagent.properties file with the com.teamcenter.fms.curl.cacerts.file property with a value that is the absolute path and file name to the cacerts.pem file. For example: Copy d:\path\to\tc\install\fsc\fsc.clientagent.properties # # com.teamcenter.fms.curl.cacerts.file=d:\path\to\tc\install\fsc\cacerts.pem Generate a trusted certificate file with only the certificates required by your CA If your CA used new certificates, you must also acquire the signer certificates from your CA. These must be contained within the cacerts.pem file. Procedure Acquire the signer certificates, in PEM format, from your CA. Append the signer certificates to a cacerts.pem file. Save the file in the FSC_HOME directory. Create or modify the FSC_HOME/fsc.clientagent.properties file with the com.teamcenter.fms.curl.cacerts.file property with a value that is the absolute path and file name to the cacerts.pem file. For example: Copy d:\path\to\tc\install\fsc\fsc.clientagent.properties # # com.teamcenter.fms.curl.cacerts.file=d:\path\to\tc\install\fsc\cacerts.pem The client (native implementation in TcServer) is now able to communicate with the FSC.