11/1/2018 4:01 PM

2/12/2026 5:14 PM

SolarWinds allows you to configure custom certificates. However, SolarWinds Support does not provide configuration assistance. If you need assistance, please contact the vendor who provided your certificate.

SSL encryption protects sensitive information that is passed over the network. This type of encryption may not be necessary in many environments and slows down the web server since all information (including graphics) must be encrypted.

Note: In DPA 9.2 and later, SSL is configured automatically, and by default uses port 8124.

These instructions use a Java Development Kit to generate a key for your server. To install an commercial key, see the advanced setup section at the end of this document.

Database Performance Analyzer

Task 1: Find or install the keytool utility

The keytool utility is often installed on a server since it is part of the Java Development Kit. If it does not exist, you must install it.

Linux

SolarWinds DPA ships a JRE for Linux as part of the product and the keytool utility can be found in the following directory:

<installDirectory>/iwc/jre_linux/bin

Windows

SolarWinds DPA ships a JRE as part of the product and the keytool utility can be found in:

C:\Program Files\SolarWinds\DPA\iwc\jre\bin

Other OS

If you are not using Windows or Linux for your DPA server, a JRE/JDK must be installed separately. The installation will include the keytool utility.

Task 2: Generate a server key using the keytool utility

Run the following command from <installDirectory>/iwc/tomcat/conf:

<keytool directory>/keytool -genkey -alias tomcat -keyalg RSA -validity 365 -keystore ./.keystore

You are prompted for two passwords. Specify "changeit" for both passwords. When asked for your first and last name, put in the name of the server instead. The server name must match the name that the user will specify in the URL. The remaining information should be answered with your own information.

Task 3: Change the server.xml file

Change the port on the SSL connectors from 8123 to 8124. The SSL connector is identified by the SSLEnabled="true" attribute. The other connector is an HTTP connector and port and must remain 8123.

Open the file <installDirectory>/iwc/tomcat/conf/server.xml and make sure the SSL connector is present within the {Service} tag. The following is an example of a server.xml file setup for SSL.

<Connector port="8124" maxHttpHeaderSize="20480" URIEncoding="UTF-8" scheme="https" secure="true" SSLEnabled="true"
  clientAuth="false" useServerCipherSuitesOrder="true" compression="on"
  compressionMinSize="2048"
  compressableMimeType="text/html,text/xml,text/csv,text/css,text/javascript"
  keystoreFile="conf/.keystore" 
  sslEnabledProtocols="TLSv1.1+TLSv1.2+TLSv1.3" 
  ciphers="ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:!DES:!3DES:
  !TLS_DHE_RSA_WITH_AES_128_CBC_SHA:!TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:!TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA:RC4+RSA:+HIGH:+MEDIUM"/>

AIX Note: For AIX uncomment the following entry instead:

<Connector port="8124" maxHttpHeaderSize="20480" URIEncoding="UTF-8" scheme="https" secure="true" SSLEnabled="true"
  clientAuth="false" useServerCipherSuitesOrder="true" compression="on"
  compressionMinSize="2048"
  compressableMimeType="text/html,text/xml,text/csv,text/css,text/javascript"
  keystoreFile="conf/.keystore" 
  sslEnabledProtocols="TLSv1.1+TLSv1.2+TLSv1.3"
  ciphers="ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:!DES:!3DES:
  !TLS_DHE_RSA_WITH_AES_128_CBC_SHA:!TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
!TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:!TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA:RC4+RSA:+HIGH:+MEDIUM"
  algorithm="ibmX509"/>

Task 4: Start DPA and view results

1. Start the DPA server (startup.sh or start the service on Windows).
2. Users should begin using https://<hostname or IP>:8124 to connect to the DPA user interface.

If the link does not work, check <iwc_dir>/iwc/tomcat/logs.

Advanced SSL setup

DPA uses Tomcat as the web server. For advanced instructions on using SSL with Tomcat, please use the following link:

http://tomcat.apache.org/tomcat-8.0-doc/ssl-howto.html 

Use a custom certificate

By default, DPA 9.2 and later automatically generates a self-signed certificate that is used for secure communication over HTTPS. The following article describes how to replace the self-signed certificate with a custom certificate:

Configure DPA to use a custom certificate for SSL/TLS