Working with SSL Certificates in ER/Studio

Summary

ER/Studio uses two different certificates:

1. Team Server HTTPS certificate (for browser access to Team Server)
2. Repository TLS certificate (for encrypted communication between Data Architect and the Repository when TLS is turned on)

When configuring these certificates, user might find themselves getting errors due to incorrect formats, naming requirements, or trust configuration. This article explains the certificate types, requirements, and steps to configure them correctly.

Note: This article might help with the following situations:

• Team Server HTTPS shows as Not Secure in browser
• Team Server fails to start after configuring HTTPS
• Configurator test fails when adding certificate
• Data Architect cannot connect to Repository when TLS enabled
• TLS communication errors between Data Architect and Repository

We recommend contacting the support team if your issue persist after going through this guide.

A. Team Server HTTPS Certificate

The product provides the ability for the user to generate a self signed certificate that can be used but is only valid for 90 days, therefore we strongly recommend users to procure their own certificate from their own network team and use that instead.

The certificate has to use the .keystore extension. It only has to be named connect.keystore if you are integrating with Collibra or Purview. Otherwise, if its just for HTTPS it can have any name (only needs the keystore file extension).

Once the SSL certificate is procured, it can be in various different formats (.pfx, .cer), therefore it will need to be converted into a keystore file. Team Server comes with a tool called “keytool” which can do the conversion from most certificate file types to a. keystore file, the steps below are specifically for converting a .pfx file, note that the commands to convert from a different file format will differ.

1. Open command prompt, then navigate to the following directory: C:\Idera\Idera Team Server 20.x\_jvm\bin\
(the exact path depends on where you have Team Server installed, as well as the exact version you’re running)

2. Then enter the following command:

keytool -importkeystore -srckeystore <path to your .pfx file including the filename.pfx> -destkeystore connect.keystore

NOTE: replace “<path to your .pfx file including the filename.pfx>” with the path where you have located the .PFX file.

3. Enter keystore password

4. Enter source keystore password

The connect.keystore was imported into C:\Idera\Idera Team Server 20.x\_jvm\bin\

5. Inside the Team Server configurator, on the HTTPS step, point to the connect.keystore location on HTTPS step in Team Server

C:\Idera\Idera Team Server 20.x\_jvm\bin\connect.keystore

6. Once that’s done, click on Test, then Update.

For more information use the Configurator guide in the following link:

https://docwiki.embarcadero.com/TeamServer/ERStudio/210/en/Install_and_Configure_Team_Server_and_Repository#HTTPS

B. Repository TLS Certificate

The second certificate is the repository TLS certificate, this is used for communication between Data Architect and the Repository when TLS is turned on.
This certificate is shipped with the product as a trial certificate , it’s also a self-signed certificate by Embarcadero, however customers are recommended to generate their own certificate and private key pair. This can be updated via the configurator repository options page, specifically under the “Optional” in the configurator, under 9. Repository Settings.

The extensions required here are .pem for the certificate and .key for the private key

For more information use the Configurator guide in the following link:

https://docwiki.embarcadero.com/TeamServer/ERStudio/210/en/Install_and_Configure_Team_Server_and_Repository#Repository_Settings

C. Self signed certificate

There might be situations, when using a self-signed certificate, that it may still appear as not secure when opening Team Server. To resolve this the certificate needs to be set to trusted on the machine, the steps to do so are below:

Export the Certificate from the Browser

1. Open the website using Chrome that shows the self-signed certificate.
   You will see a security warning such as “Your connection is not private”.
2. Click Advanced, then select Proceed to site.
3. Click the Not secure indicator in the browser address bar.
4. Click the certificate information to open the certificate viewer.
5. Go to the Details tab.
6. Click Copy to File to launch the Certificate Export Wizard.
7. Select the export format:
   • DER encoded binary X.509 (.cer)
   • or Base-64 encoded X.509 (.cer)
8. Specify a file’s name and location.
9. Click Finish to export the certificate.

Install the Certificate into the Trusted Store

10. Locate the exported .cer file.
11. Double-click the file and click Install Certificate.
12. Select Local Machine (to trust all users).
13. Choose Place all certificates in the following store.
14. Select Trusted Root Certification Authorities.
15. Click Next.
16. Click Finish.
17. When prompted with the security warning, click Yes.
18. Confirm the message appears stating the import was successful.

Verify Trust

19. Close all browser windows.
20. Reopen Chrome.
21. Navigate to the website again.
22. The security warning should no longer appear, and the connection should now be trusted.