Page History

...

• Create the Java Keystore using the Keytools from your Java JRE.
  • Generate the Java Keystore with the private key and the certificate for the JobScheduler Master and export the certificate to a second Keystore that is later on used by the JOC Cockpit.

    • Example for JKS keystore format

      Code Block
      title Example how to generate a Keystore with private key and certificate
      keytool -genkey -alias "master-https" -dname "CN=jobSchedulerHost,O=myCompany" -validity 1461 -keyalg RSA -keysize 1024 -keypass jobscheduler -keystore "SCHEDULER_DATA/config/private/private-https.jks" -storepass jobscheduler

    • Example for PKCS12 keystore format

      Code Block
      title Example how to generate a Keystore with private key and certificate
      keytool -genkey -alias "master-https" -dname "CN=jobSchedulerHost,O=myCompany" -validity 1461 -keyalg RSA -keysize 1024 -keypass jobscheduler -keystore "SCHEDULER_DATA/config/private/private-https.pk12" -storepass jobscheduler -storetype PKCS12

    • Explanations

      • Replace the SCHEDULER_DATA placeholder as specified above.
      • The -dname option specifies the certificate issuer, therefore use your own set of CN, OU, DC that specify the issuer's distinguished name. The O setting is required for the issuer.
      • The -keypass option accepts the password that you will need later on to manage your private key. With the default password being used no further settings are required as explained below.
      • The -keystore option specifies the location of your Keystore file. 
        • The Keystore file should be in reach of the JobScheduler Master, it is therefore recommended to create a sub-folder private in the ./config directory.
        • Using the default file name "private-https.jks" will save the effort of adding further settings as explained above.
      • The -storepass option specifies the password for access to your Keystore file. For the handling of the default password the same applies as stated with the -keypass option.
      • The -storepass option is used for the PKCS12 keystore format, this option is not required for the JKS keystore format.
  • If not otherwise configured then the JobScheduler Master by default uses the password jobscheduler for the respective Keystore.
  • If you choose an individual password for the JobScheduler Master Keystore then adjust the following properties in the SCHEDULER_DATA/config/private/private.conf configuration file:
    • Explanations
      • jobscheduler.master.webserver.https.keystore.file is used for the path to the Keystore
      • jobscheduler.master.webserver.https.keystore.password is used for the Keystore password
      • jobscheduler.master.webserver.https.keystore.key-password is used for the password of your private HTTPS certificate

    • Example

      Code Block
      language text title Sample private.conf file
      jobscheduler.master.webserver.https.keystore { file = "C:/ProgramData/sos-berlin.com/jobscheduler/master110/config/private/private-https.jks" # Backslashes are written twice (as in JSON notation): # file = "\\\\other-computer\\share\\my-keystore.jks" password = "secret" key-password = "secret" }

• Export the JobScheduler Master public certificate for use with the JOC Cockpit Web Service

  • Example for export with JKS keystore format

    Code Block
    title Sample for export certicate
    keytool -exportcert -rfc -noprompt -file "master-https.pem" -alias "master-https" -keystore "SCHEDULER_DATA/config/private/private-https.jks" -storepass jobscheduler

  • Example for export with PKCS12 keystore format

    Code Block
    title Sample for export certicate
    keytool -exportcert -rfc -noprompt -file "master-https.pem" -alias "master-https" -keystore "SCHEDULER_DATA/config/private/private-https.jksp12" -storepass jobscheduler -storetype PKCS12

  • The exported certificate of each JobScheduler Master has to be imported to the Java Keystore (rather Truststore) which is used by the JOC Cockpit.

...

• Specify the HTTPS port with the https_port attribute of the <config> element in the SCHEDULER_DATA/config/scheduler.xml configuration file like this:

  Code Block
  language xml
  <spooler> <config http_port="40444" https_port="48444" mail_xslt_stylesheet="config/scheduler_mail.xsl"> <!-- other elements --> </config> </spooler>

• Should you use a keystore in PKCS12 format then the Master until version 1.12.4 has to know the keystore password. This is not required for keystores in JKS format. Specify the type and password for a PKCS12 keystore with the  SCHEDULER_DATA/config/factory.ini configuration file like this:

  Code Block
  language xml
  [java] options = -Dlog4j.configuration="file:///${SCHEDULER_HOME}/lib/log4j.properties" -Djavax.xml.transform.TransformerFactory="net.sf.saxon.TransformerFactoryImpl" -Djavax.net.ssl.keyStoreType="PKCS12" -Djavax.net.ssl.keyStorePassword="jobscheduler"

...