Client to Server SSL¶

Make each MetaMiner Client workstation trust the certificate of a MetaMiner Server that runs with SSL.

How it works¶

The MetaMiner Client (MMC) has no SSL setting. When it connects, it detects whether the MetaMiner Server (MMS) uses SSL and switches to TLS by itself.

The MMC checks the server certificate against its own Java trust store, not the Windows certificate store. Out of the box that trust store holds the public CAs shipped with Java. If your MMS certificate comes from a company CA, add that CA to a trust store and point the MMC at it. Add the issuing (intermediate) CA, because the MMS does not send the rest of the chain.

Before you begin¶

SSL is on for the MMS. See MetaMiner Server SSL.
The certificate of the CA that issued the MMS certificate, for example company-ca.cer. Ask your PKI team for the issuing CA, not the server certificate.
Administrator rights on the workstation.

Steps¶

Create the folder for the trust store. keytool does not create folders.
```
mkdir "C:\ProgramData\Infolytik"
```

Start from the CAs MetaMiner already trusts:

Copy the bundled trust store

"C:\Program Files\Infolytik\MetaMiner\jre\bin\keytool.exe" -importkeystore ^
  -srckeystore "C:\Program Files\Infolytik\MetaMiner\jre\lib\security\cacerts" -srcstorepass changeit ^
  -destkeystore "C:\ProgramData\Infolytik\mm-truststore.p12" -deststoretype PKCS12 -deststorepass <password>

Add your issuing CA:

Import the issuing CA

"C:\Program Files\Infolytik\MetaMiner\jre\bin\keytool.exe" -importcert -noprompt -alias company-ca ^
  -file company-ca.cer -keystore "C:\ProgramData\Infolytik\mm-truststore.p12" -storepass <password>

Check the import. The entry must show trustedCertEntry and the owner must be your CA, not the MMS host:

"C:\Program Files\Infolytik\MetaMiner\jre\bin\keytool.exe" -list -v -alias company-ca ^
  -keystore "C:\ProgramData\Infolytik\mm-truststore.p12" -storepass <password>

Add three lines to C:\Program Files\Infolytik\MetaMiner\client\MetaMiner.ini. Number them after the last vmarg line already in the file, with no gaps (for example 25, 26 and 27):
client\MetaMiner.ini (excerpt)
```
vmarg.25=-Djavax.net.ssl.trustStore=C:\ProgramData\Infolytik\mm-truststore.p12
vmarg.26=-Djavax.net.ssl.trustStorePassword=<password>
vmarg.27=-Djavax.net.ssl.trustStoreType=PKCS12
```
These settings are kept when the MetaMiner Client is upgraded.
Copy mm-truststore.p12 and the edited MetaMiner.ini lines to the other workstations, for example with your software distribution tool.

The trust store holds only public certificates

The file contains CA certificates, not private keys. The password protects its integrity.

Verify¶

Start the MetaMiner Client and connect to the server as usual.
The connection opens without a certificate warning, and the status bar shows you are connected.

Do not accept certificate warnings

If the MMC says "This CA Root certificate is not trusted because it is not in the Trusted Root Certification Authorities store", click No and fix the trust store on that workstation. Tell users to report this warning instead of accepting it.

Troubleshooting¶

The certificate warning still appears after the import

The imported certificate is the MMS server certificate instead of the issuing CA. Check step 4.
The vmarg numbers have a gap, so the lines are ignored. Renumber them.
The path or password in MetaMiner.ini does not match the file.

The client connects to a server without SSL

That is expected. The MMC uses plain connections with servers that do not have SSL.

Browsers show a certificate warning for the web console

Browsers use the workstation's Windows certificate store. Distribute your CA with Group Policy or Intune.