Skip to content

Trusted Certificates

How the MetaMiner Server decides whether to trust the HTTPS certificate of a BusinessObjects web service, and how to trust a company or self-signed certificate from the MetaMiner Administrator.

How it works

The MetaMiner Server (MMS) and the MetaMiner Administrator (MMA) call the BusinessObjects RESTful web service over HTTPS, for example to read Web Intelligence documents. They accept a certificate when it chains to a CA in any of these stores:

Store Contents Managed with
Java default trust store Public CAs shipped with the bundled Java MetaMiner updates
Windows Trusted Root Certification Authorities store of the server Your company root CAs, usually distributed by Group Policy Windows (certlm.msc, Group Policy)
MetaMiner trust store server\config\mm-truststore.p12 Certificates you trust from MMA MMA trust prompts

The certificate name must also match the host name in the URL, unless you exempt that host.

If your BusinessObjects web tier uses a certificate from a CA that is already in the Windows Trusted Root store of the MMS host, you do not need to do anything.

Trust a certificate from MMA

When MMA validates an environment and cannot verify the web service certificate, it shows Untrusted TLS Certificate with the host, subject, issuer, validity dates and SHA-256 fingerprint.

  1. Compare the SHA-256 fingerprint with the value from your BusinessObjects or PKI administrator.

  2. Choose:

    Button Effect
    Trust Issuing CA Trusts the CA that issued the certificate. Covers every host signed by that CA. Recommended for company CAs
    Trust This Host Trusts this certificate only. Shown for self-signed certificates
    Cancel Trusts nothing. Validation fails

  3. MMA saves the certificate to server\config\mm-truststore.p12 and shows Certificate Trusted.

  4. If the MetaMiner Server is running, restart it. The running server reads the trust store at startup.

Image of the Untrusted TLS Certificate dialog showing subject, issuer, validity, SHA-256 and the Trust Issuing CA, Trust This Host and Cancel buttons

../images/security/mma-untrusted-tls-certificate.png

Check the fingerprint

Trust a certificate only after you confirm its fingerprint with the owner of the server. Trusting a certificate you have not checked lets anyone who presents it read the traffic.

Certificate name mismatch

When the certificate is trusted but its names (CN or Subject Alternative Name) do not include the host you entered, MMA shows Certificate Name Mismatch with the names on the certificate and the host you connect to.

The best fix is one of these:

  • Change the URL in the environment to a name that is on the certificate.
  • Ask your PKI team to reissue the certificate with the host name you use.

If neither is possible, click Skip Hostname Check. Trust is still enforced; only the name check is skipped, for that host only. MMA saves the host in server\config\mm-hostname-exemptions.properties. Restart the MetaMiner Server if it is running.

Image of the Certificate Name Mismatch dialog with the certificate names, the host and the Skip Hostname Check button

../images/security/mma-certificate-name-mismatch.png

Review and remove trust

To Do this
See trusted certificates "C:\Program Files\Infolytik\MetaMiner\jre\bin\keytool.exe" -list -keystore "C:\Program Files\Infolytik\MetaMiner\server\config\mm-truststore.p12"
Remove a hostname exemption Delete the host's line from server\config\mm-hostname-exemptions.properties, then restart the MetaMiner Server
Remove a trusted certificate Delete the entry from mm-truststore.p12 with keytool -delete -alias <alias>, then restart the MetaMiner Server

Include both files in your periodic access review and protect server\config with NTFS permissions.

TODO: document the trust store password for keytool commands

Confirm the password of mm-truststore.p12 (configuration key mm.truststore.password) that customers should use with keytool.

Advanced settings

Trust store locations
System property Default Effect
mm.truststore.path config\mm-truststore.p12 Location of the MetaMiner trust store
mm.hostname.exemptions.path config\mm-hostname-exemptions.properties Location of the hostname exemptions file

Paths are relative to the server folder. Set them in MetaMinerServer.properties so the MMS and MMA use the same files.