8.9. Securely Connecting to EKM (Optional)

Engineering Knowledge Manager

Installation Guide | Chapter 8: Installing a Front-End Web Server |

8.8.3. Enabling Secure Connections to JBoss for Single-Node EKM Server (Optional) |  | Chapter 9: Configuring Login Authentication and Access Settings
Prev |  | Next

## 8.9. Securely Connecting to EKM (Optional)

If you have enabled secure connections on the front-end web server or in JBoss on a single-node EKM server, connect to EKM on the following URL, using HTTPS instead of HTTP:

EKM Secure URL: `https://ekm.yourdomain.com/ekm`

where `ekm.yourdomain.com` is the name of the front-end web server or JBoss server (single-node EKM server only). The EKM login window should appear in your browser. You are now accessing EKM securely via an encrypted HTTPS connection. You should see a visual indication in your browser that you are connected securely to EKM, such as a "lock" icon in the URL entry field and in the lower right-hand corner of the browser window.

### Connecting to EKM from Workbench or Another EKM Server Using HTTPS

If you are using a certificate from a trusted Certificate Authority (CA) to secure your EKM server, you can securely connect to EKM from Workbench without any additional setup. The same applies when you are using the Expand Search feature in EKM to expand a search to another EKM server.

If, on the other hand, you are using a self-signed certificate, you must import the certificate into Java's keystore. Otherwise, Java will not trust the certificate that you are using to secure the server, and will therefore not create a secure connection.

The Java Runtime Environment (JRE) has a file named cacerts that contains a list of trusted CA certificates that the JRE uses to negotiate secure connections. Self-signed or unknown CA certificates must be explicitly imported into the cacerts file in order for Workbench or another EKM server to successfully connect to EKM using HTTPS.

### Importing a Self-signed Certificate into Java’s Keystore

If you are using a self-signed certificate to secure an EKM server, follow the steps below to import the certificate into Java’s keystore.

1. Export the self-signed certificate to a file using a browser, or obtain the certificate file from the server.

   If using a browser, the steps for exporting a certificate will vary for each type of browser (Chrome, Firefox, and so on). Consult the documentation for your browser for more information.

   If obtaining the certificate file from the server, the method will depend on the web server being used, and the way in which the certificate was installed on the server.

2. Use the command line to import the certificate into the cacerts file.

   The example below shows the command line when importing the certificate for Workbench:

       C:\Users\username>keytool -import -alias EKM -keystore
       "C:\ANSYS Inc\v182\EKM\programs\jre1.8.0_121\lib\security\cacerts"
       -file "C:\Apache\conf\keystore\EKM.crt"

   Note that the path will be different depending on the application for which you are importing the certificate. For example, if you are importing the certificate for an EKM server, the command line may look like this:

       C:\Users\username>keytool -import -alias EKM -keystore
       "C:\ekm\v182\programs\jre1.8.0_121\jre\lib\security\cacerts"
       -file "C:\Apache\conf\keystore\EKM.crt"

3. When prompted, enter the password of the client keystore. The example below shows the default password on every JRE cacerts file: `changeit`.

       Enter keystore password: changeit

4. When prompted to trust the certificate, enter `yes`.

       Trust this certificate? [no]: yes

   The following confirmation is displayed:

       Certificate was added to keystore

Contains proprietary and confidential information of ANSYS, Inc. and its subsidiaries and affiliates.

Prev | Up / Contents | Next

Release 18.2 - © ANSYS, Inc. All rights reserved.