XIC: How to remove and regenerate the certificate of alias xic from the XIC.jks keystore file

XIC: How to remove and regenerate the certificate of alias xic from the XIC.jks keystore file

Step 1. Give write security on keystore
syntax: chmod 600 <keystore-file>
example: chmod 600 XIC.jks

Step 2. Cleaning XIC.jks file, if there is a certificate chain for xic alias
syntax: keytool -delete -keystore <keysotre-file> -alias <alias-name>
example: keytool -delete -keystore XIC.jks -alias <the-alias-name-for-the-root-certificate-of-the-alias-xic>
example: keytool -delete -keystore XIC.jks -alias <the-alias-name-for-the-intermediate-certificate-of-the-alias-xic>
example: keytool -delete -keystore XIC.jks -alias xic

Step 3. Execute keytool to generate private key.
syntax: keytool -genkeypair -alias <alias-name> -keyalg <key algorithm name> -keysize <key-bit-size> -sigalg <signature-algorithm-name> -validity <validity-number-of-days> -keystore <keystore-filename> -dname <distinguished-name>
example: keytool -genkeypair -alias xic -keyalg RSA -keysize 4096 -sigalg sha256withRSA -validity 730 -keystore XIC.jks -dname CN=example.nonstop.XIC,OU=exampleUnit,O=exampleOrg,L=exampleCity,S=exampleState,C=ZZ

Step 4. Execute keytool to generate .CSR file.
syntax:keytool -certreq -alias <alias-name> -keystore <keystore-file> -file <CSR-filename>
example: keytool -certreq -alias xic -keystore XIC.jks -file example.nonstop.XIC.csr

Step 5. Check the certificates in the XIC.jks keystore file
syntax: keytool -list -v -keystore <keystore-file>
example: keytool -list -v -keystore XIC.jks

Step 6. Send the CSR file to the Trusted CA provider

Step 7. Get the certificate package from the Trusted CA provider

Step 8. Upload the certificate package in the CER file

Step 9. Import the certificates
Any alias name can be used for the root and intermediate certificates, but the alias name for the server(or leaf) certificate must be xic.
syntax: keytool -importcert -alias <alias-name> -keystore <keystore-file> -file <the-uploaded-cer-file>
example: keytool -importcert -alias rootExam -keystore XIC.jks -file rootExam.cer
example: keytool -importcert -alias intermediateExam -keystore XIC.jks -file interExam.cer
example: keytool -importcert -alias xic -keystore XIC.jks -file xicExam.cer

Step 10. Make the XIC.jks file read only
syntax: chmod 400 <keystore-file>
example: chmod 400 XIC.jks

Step 11. Validate the certificate chain in the XIC.jks keystore file
syntax: keytool -list -v -keystore <keystore-file>
example: keytool -list -v -keystore XIC.jks

Note: Client-Side setup
You may need to add the necessary trusted root and intermediate certificates of the certificate chain to the client environment if they do not already exist.

Step 12. Restart the XIC instance.

Step 13. Verify the connection.
For example, click the 'TestConnection' button on the Sailpoint IIQ

    • Related Articles

    • XIC: Updating certificates in the XIC_HPE.jks

      1. Grant WRITE permissions on the XIC_HPE.jks and its related files, such as XIC_HPE_EP.ssl, XIC_HPE_PrivatePair.pem, and XIC_HPE_PubKey.pem 2. Execute the 'importCert.sh' script in the XIC installation's base directory, for example, ...

    • XIC: steps to use CA signed certificate between XTR and XIC

      In the XTR installation: the CSR file needs to be created and then the CA Signed Certificate needs to be uploaded to the XTR installation - Validate all entries on the SSLTRCFG file. Note: CA_Cert should be SSLCACRT created by XTR installation. ...

    • XS1: How to generate a new SSL certificate for version 1.70

      Following are the instructions to generate the new SSL cert: The new certificate should be generated in PKCS12 format Ensure the Subject Alternative Name (SAN) contains the domain/DNS name used to connect to the XS1 website. Contact XYPRO Support for ...

    • XIC 1.36 or below release is not working with Java 11.

      XIC has to be reinstalled after setting up PATH for Java version 1.80 1. Shutdown XIC 2. Remove the XIC or rename the XIC directory, for example, mv ./webservices ./webservices_bak 3. Set PATH to Java version 1.80, for example, ...

    • XS1: Error creating Keystore Password

      The error in question appears when opening the XS1 Installation file located at: xs1\libraries\scripts\run.installer.bat An example of the error is below: Upon getting this error choose Option 3: Configure XTR Connection The errors below should ...