Configure DPA to use a custom certificate for SSL/TLS

11/7/2018 6:45 PM

2/12/2026 5:12 PM

By default, DPA automatically generates a self-signed certificate that is used to establish secure communication over HTTPS. This article describes how to replace the self-signed certificate with a custom certificate.

SolarWinds allows you to configure custom certificates. However, SolarWinds Support does not provide configuration assistance. If you need assistance, please contact the vendor who provided your certificate.

NOTE: This article uses an application called Portecle for managing key stores. Download Portecle from: https://portecle.sourceforge.net.

• DPA is based on Apache Tomcat. For more information on configuration, see SSL/TLS Configuration HOW-TO for the appropriate version of Tomcat.

Before you begin, you must contact your administrator to determine the certificates required for your environment.

This certificate can be a wildcard certificate, and can be signed by a public Certification Authority (CA) or by a CA specific to your company.

 

Database Performance Analyzer

- Possible re-domain of the DPA server
- Corrupted DPA file
- Creating custom SSL from Certificate Authority

Important! Make a backup of the DPA key store file. The default location is:  

<DPA-dir>/iwc/tomcat/conf/.keystore

To run Portecle using the embedded Java Runtime (JRE) that is included with DPA by running the following command:

• Windows: <DPA-dir>\iwc\jre\bin\java.exe -jar <Portecle-dir>\portecle.jar
• Linux: <DPA-dir>/iwc/jre_linux/bin/java -jar <Portecle-dir>/portecle.jar

Note:  You may have manually overridden the key store location or the password in the <DPA-dir>/iwc/tomcat/conf/server.xml file using the keystoreFile and keystorePass attributes.

Follow steps based on what files you already have.

• To import an existing Java keystore prepared from your administrator (with an extension of .jks), follow the steps in Case A.
• To import an existing key pair (with .p12 or .pfx ), follow the steps in Case B.
• To manually create a key pair, create a certificate signing request and install the public key, follow the steps in Case C.

Case A: Import existing Java keystore

1. Open the keystore by clicking File > Open Keystore File.
2. Enter the password provided by your administrator.
3. If the type of keystore is not JKS, click Tools > Change Keystore Type > JKS. Enter the password provided by your administrator.
4. You should see more entries, one entry on one row. One of them is the signed certificate (it should have an con with two keys on the left).

   You can make sure that it is the certificate you need by:

   1. Right-click the certificate, and click Certificate Details.
   2. Check the host name in the Subject field (For example, "CN=hostname, O=organization").
   3. Right-click the entry, and click Rename.
   4. Enter the alias tomcat and click OK.

   If the certificate entry is incorrect, you cannot use the keystore file. Follow the steps in Case C to continue.

5. Click File > Save Keystore, and save it to <DPA-dir>/iwc/tomcat/conf/.keystore.
6. If the password provided by your administrator is not the default (changeit), you must:
   1. Edit the <DPA-dir>/iwc/tomcat/conf/server.xml file.
   2. Add the following attributes to the tomcat connector:

      keystorePass="<KEYSTORE_PASSWORD>" keyPass="<CERTIFICATE_KEY_PASSWORD>"

      The certificate key password is usually the same as the keystore password.

   3. If DPA version is 2025.X or higher use the following as the attributes in the tomcat connector instead:

                       certificateKeystorePassword="<KEYSTORE_PASSWORD>"

           certificateKeyPassword="<CERTIFICATE_KEY_PASSWORD>"

1. Restart DPA.

Case B: Import existing PFX / P12

1. Open the DPA key store by clicking File > Open Keystore File.

   By default, the DPA keystore is located at <DPA-dir>/iwc/tomcat/conf/.keystore.

2. Enter the keystore password.  By default, it is changeit.
3. If a key pair with an alias name of tomcat exists in the keystore, right-click and select Delete.

   

4. Click Tools > Import Key Pair.

5. In the PKCS#12 Keystore Password field, enter the password for the PFX/P12 File.
6. In the Import Key Pair menu, select the certificate to import.
7. Click Import.
8. In the Key Pair Entry Alias field, change the alias name to tomcat.
9. Click OK.
10. Enter a new password to protect the key pair.  (Note: This password will be entered in the server.xml.)
11. Edit the <DPA-dir>/iwc/tomcat/conf/server.xml file and add the following attribute to the Tomcat Connector:

    keyPass="<CERTIFICATE_KEY_PASSWORD>" <----- Enter password from step #10

      If DPA version is 2025.X or higher use the following as the attributes in the tomcat connector instead:

            certificateKeyPassword="<CERTIFICATE_KEY_PASSWORD>"

5. Click File > Save Keystore.
6. Restart DPA.

Case C: Create key pair, generate certificate signing request (CSR) and import public key

If a previously installed certificate was renewed, it is important to submit a new certificate signing request to the certificate authority (CA).  If a certificate signing request was not generated, the new issued certificate cannot be imported.

Task 1: Create the key pair

1. Open the DPA key store by clicking File > Open Key Store File.
   By default, the DPA keystore is located at <DPA-dir>/iwc/tomcat/conf/.keystore.
2. Enter the password. The DPA default password is changeit.
3. If a key pair with alias name tomcat exists in the keystore, right-click and select Delete.

   

4. To create a new key pair, click Tools > Generate Key Pair.
5. For Key Algorithm, select RSA.
6. For Key Size, enter 2048 (or 4096).
7. Click OK.
8. In the Generate Certificate field, enter the certificate information.
   • Common Name field MUST contain the fully qualified domain name (FQDN) used to connect to the DPA web console.
   • Signature Algorithm should be SHA256withRSA
9. Click OK.

Task 2: Generate a certificate signing request (CSR)

1. To generate a key pair using keytool, complete the following steps:
   1. Navigate to the following directory: <DPA-dir>\iwc\jre\bin\
   2. Run the following command:
      
      keytool -genkeypair -keystore <DPA-dir>/iwc/tomcat/conf/.keystore -dname "CN=<DPA FQDN>, OU=OrganizationUnit, O=OrganizationName, L=LocalityName, ST=StateName, C=Country" -keyalg RSA -alias tomcat -sigalg SHA256withRSA -ext SAN=dns:<DPA FQDN> -validity 365
      
      Note: Common Name and DNS for SAN SHOULD be the identical. This should contain the fully qualified domain name (FQDN) for the DPA used in the browser (i.e. dpa.solarwindslab.com)
      • -keystore provide the location of keystore file (default is <DPA-dir>/iwc/tomcat/conf/.keystore.)
      • -sigalg specifies the signature algorithm name
      • SAN is the Subject Alternative Name and it allows multiple values (DNS or IP address) to be associated with the certificate.
      • -validity is the number of days that the keypair is valid.
2. Click File > Save As, and save the keystore as the DPA .keystore file. By default, this file is in the following location:
   <DPA-dir>/iwc/tomcat/conf/.keystore
3. Confirm overwriting the original .keystore file if prompted.
4. To generate a Certificate Signing Request (CSR), right-click the tomcat key pair, and select Generate Certification Request.
   
5. To generate a certificate signing request using keytool:, run the following keytool command:
   
   keytool -certreq -keystore <DPA-dir>/iwc/tomcat/conf/.keystore -alias tomcat -storepass changeit -ext "SAN=dns:<DPA FQDN>" -file cert.csr
   
   where -file will be the file name for the certificate signing request file (for example, cert.csr).
6. In Portecle, click File > Open Keystore File. (Save changes if prompted.) Then select the keystore file you generated in the previous step. By default, this is located in <DPA-dir>/iwc/jre/bin/.
7. Submit the CSR to your CA.
   Your CA will provide a signed certificate (with an extension of .cer, .p7b, .crt, .der). You will also need the trusted certificate chain in separate files (usually with an extension of .cer, .p7b, .crt, .der). If you do not have it, ask your administrator.

Task 3: Import the public key

1. To import the trusted certificate, click Tools > Import Trusted Certificate to import the whole trust chain of your server certificate, starting from the Root CA certificate and progressing down the chain. Typically this means importing the Root CA certificate and one or more intermediate certificates. For every imported certificate, you must choose a unique alias.
   When importing the Root CA certificate, Portecle may ask you to accept the certificate as trusted in the following dialog:
   
   
   
   If this prompt appears for any certificate other than the Root CA certificate, it indicates that you are importing the wrong certificates (or in the wrong order) and HTTPS connections may not work correctly.
   • To import trusted certificate using keytool, run the following command:
     
     keytool -importcert -file <location of trusted cert> -keystore <DPA-dir>/iwc/tomcat/conf/.keystore
      
   • To Import the signed certificate by right-clicking the tomcat key pair, select Import CA Reply.
     
     
      
   • To import the signed certificate using keytool, run the following command:
     
     keytool -importcert -file <location of cert> -alias tomcat -keystore <DPA-dir>/iwc/tomcat/conf/.keystore
2. Click File > Save Keystore.
3. Restart DPA.