Installing Intermediate Certificates for Software Assistant
Page 1
Installing Intermediate Certificates for
Software Assistant
September 13, 2011
Introduction
Secure internet connections are controlled by the use of trusted certificates. When Software Assistant
(SWA) negotiates with systems within Hewlett-Packard it will not proceed without checking these
certificates to ensure a secure connection. In order for this validation to take place there must be
certificates that the system already trusts. These are the root certificate authorities (root CAs).
Recently Hewlett-Packard and VeriSign updated from 1024 bit to 2048 bit certificates. While this
provides increased security, systems may not have the correct certificates installed. SWA relies on the
Java Runtime Environment (JRE) to provide the required root CA information. At the time of this writing
the current version of the JRE does not deliver the required certificates. This document will describe
how to add them manually on an HP-UX system.
Identifying the problem
If the HP certificates are not trusted, the earliest connection attempt will fail. This will result in an error
message similar to:
ERROR: Failed to access authorization service.
This error can be seen for other reasons such as the need to specify a proxy or a local firewall blocking
access. To determine if this error is caused by a certificate issue, check to see if the JRE has the VeriSign
Class 3 Secure Server CA – G3 intermediate certificate required. To do this use the Java keytool
command to query the keystore for the exact fingerprint as shown below (HP-UX system with Java60JRE
installed):
# /opt/java6/jre/bin/keytool -list \
-keystore /opt/java6/jre/lib/security/cacerts -storepass changeit |\
grep –i –e “3C:48:42:0D:FF:58:1A:38:86:BC:FD:41:D4:8A:41:DE”
Certificate fingerprint (MD5): 3C:48:42:0D:FF:58:1A:38:86:BC:FD:41:D4:8A:41:DE
If the Certificate fingerprint is not found, use the instructions that follow to install it on your system. The
keytool command exists for both Java 1.5 and Java 6 and each version contains its own keystore. The
command above can be modified for keytool and keystore path. The password listed is the default
value.