Configure mutual authentication for server and agent

Prerequisites: Add an alias to an agent

This topic describes how to finish setting up mutual authentication between a server and agent.

To exchange certificates between a server and agent:

  1. Stop the Deployment Automation server and agent.
  2. Open a command prompt and navigate to the conf directory on your server: <da_profile_directory>\conf.

  3. Export the server key as a certificate by running this command:

    keytool -export -keystore server.keystore -storepass changeit -alias server -file server.crt

    Note: The alias server for generating certificate keys is assigned during server installation.

  4. Copy the exported certificate file server.crt to the agent directory:

    <agent_install_directory>\<agent_name>\conf

    where<agent_name> is the unique name you gave the agent during installation.

  5. From the agent directory <agent_install_directory>\<agent_name>\conf, import server.crt by running this command:

    keytool -import -keystore agent.keystore -storepass changeit -alias server -file server.crt -keypass changeit -noprompt

    A message Certificate was added to keystore is displayed.

  6. From the agent directory <agent_install_directory>\<agent_name>\conf, export the agent key as a certificate by running this command:

    keytool -export -keystore agent.keystore -storepass changeit -alias <agent_alias> -file <agent_name>.crt

    The certificate is stored in the <agent_name>.crt file.

    Note: Before you export an agent key, you must add an alias to the agent. For details, see Add an alias to an agent. After generating a new key pair, make sure to remove the default key from keystore.

  7. Copy the exported certificate file <agent_name>.crt to your server's conf directory.

  8. From the server's conf directory, import the <agent_name>.crt file by running this command:

    keytool -import -keystore server.keystore -storepass changeit -alias <agent_alias> -file <agent_name>.crt -keypass changeit -noprompt

    A message Certificate was added to keystore is displayed.

  9. To configure another agent, repeat steps 6–8.

  10. Start the server and agent.

Back to top

Next steps: