Convert sites that use symmetric keys to use asymmetric keys

You can update an existing FMS deployment that uses symmetric keys to one that uses asymmetric keys. Perform the following tasks to update an existing FMS deployment: Prepare for the update. Set the Teamcenter preference to specify using asymmetric keys. Generate a new public-private key pair in the Teamcenter deployment. Export the public key from Teamcenter to a keystore file. Generate and add the symmetric key to the asymmetric keystore. Deploy the keystore file on the FSC and update the FSC configuration. Restart all processes. Run all commands from a Teamcenter command prompt. Commands requiring credentials must be run by a Teamcenter administrator with DBA privileges. Prepare for the update Shut down the FSCs, Pool Manager, and all TcServer processes using the Teamcenter Management Console. Set the Teamcenter preference to specify using asymmetric keys Use the preferences_manager utility to set the FMS_USE_ASYMMETRIC_KEYS preference as follows: Copy preferences_manager -u=Tc-admin-user -p=password -g=group -mode=import -scope=SITE -action=OVERRIDE -preference=FMS_USE_ASYMMETRIC_KEYS -values="true" Generate a new public-private key pair in the Teamcenter deployment Run the install_fms_keys utility to generate a new private key in the Teamcenter database as follows: Copy install_fms_keys -u=Tc-admin-user -p=password -g=group -f=install The key is created and installed in the Teamcenter database. Export the public key from Teamcenter to a keystore file Once the private key is generated and updated in the database, use the install_fms_keys utility to export the public key corresponding to the private key as follows: Copy install_fms_keys -u=Tc-admin-user -p=password -g=group -f=exp_pubkey -file_password=key_pass Where key_pass is the password for the exported keystore file. The public key is exported from the Teamcenter database and saved in the current directory as a keystore file named FMSPublicKeys.p12. Generate and add the symmetric key to the asymmetric keystore With asymmetric keys configured for ticket validation for file operations, FMS still uses a symmetric key for administrative commands. Use the keygen.bat utility (keygen.sh on Linux) to add this symmetric key to the keystore (.p12 file) that holds the public key for file operations: Copy keygen -genadminkey -keystore p12_keystore_file -storepass key_pass Where: p12_keystore_file The file name of the .p12 file holding the public key (FMSPublicKeys.p12). key_pass The password of the .p12 file holding the public key (FMSPublicKeys.p12). The administrative key is generated and added to the FMSPublicKeys.p12 keystore. Deploy the keystore file on the FSC and update the FSC configuration Use the following steps to update the FSC to use asymmetric keys and the new keystore file: Procedure Copy the .p12 keystore file to the FSC_Home directory. Update the FMS primary configuration file (FSC_HOME\fmsmaster_fscid.xml) to specify using asymmetric keys by adding a ticketkeys element. For example: Copy Where: p12_keystore_file The file name of the .p12 keystore file created earlier (FMSPublicKeys.p12). Include the path to the file if the file is not stored in FSC_Home. site_ID The ID of your site. pub_key_alias The public key (stored in the .p12 keystore file) alias. The alias is the same as site_ID. Use the passwordtool.bat utility (passwordtool.sh on Linux) to generate an encrypted password for the keystore file. For example: Copy passwordtool -encrypt ekey_pass Where ekey_pass is the encrypted password for the keystore file. Add the following line to the FMS server configuration properties file (FMS_HOME\fsc.properties or FSC_HOME\fsc_fscid.properties) to specify using the new keystore password: Copy com.teamcenter.fms.public.keystore.epassword=key_pass Where key_pass is the encrypted password generated in the previous step using passwordtool. Add the following lines to the FSC_HOME\fscadmin.properties: Copy com.teamcenter.fms.signing.keystore.file=keystore_path Copy com.teamcenter.fms.signing.keystore.epassword=ekey_pass Copy # Alias name from entry added in fmsmaster xml com.teamcenter.fms.signing.tickets.alias=admin Where: keystore_path The name of the .p12 keystore file created earlier (FMSPublicKeys.p12). If the keystore file is not in FSC_HOME, include the path to the file. ekey_pass The encrypted password for the keystore file. Restart all processes Restart the FSCs, Pool Manager, and all Teamcenter server processes shut down before the update using the Teamcenter Management Console.