Enable certificate revocation checking in DPA

8/19/2020 11:05 PM

8/21/2020 12:12 AM

DPA uses trusted certificates to establish secure connections with third-party systems such as monitored database instances, LDAP servers, and email servers. In DPA 2020.2.1 and later, you can configure DPA to check with the Certificate Authority (CA) to verify that a certificate has not been revoked. A certificate could be revoked, for example, if its private key has been compromised or stolen. 

When a certificate is revoked (or when it expires), any connections that it enabled are invalidated as soon as there is a request for a new connection in the connection pool. How frequently new connections are requested can be controlled through the connection pool properties. For database connection pools, the maxConnectionAge and maxIdleTime settings affect how long a connection stays in the pool. A new connection is also requested when you restart DPA or stop and restart monitoring a database instance. For LDAP servers, you can disable connection polling by setting com.confio.security.ldap.connect.pool=false in idc-security.properties.

The prerequisite for trust management in DPA is that local customer CA certificates must be imported into global Java Trust Store or the DPA Trust Store. DPA trusts certificates that are stored in the cacerts file that is shipped with each new version of Java. DPA also allows users to import certificates into the DPA Trust Store. Importing custom certificates into the DPA Trust Store ensures that they are not dropped during the Java runtime upgrade that usually occurs when DPA is upgraded. These two trust stores are merged into a single list in DPA runtime. To establish trust for local customer CA certificates, you can do either of the following:

• Import the certificate into the DPA Trust Store. This is recommended because the certificate will be retained when you upgrade DPA.
• Import the certificate into the Java Trust Store. You can manage the Java Trust Store using the standard keytool command. The cacert file is stored under embedded JRE (DPA/iwc/jre/lib/security/cacerts). Keytool documentation is available at https://docs.oracle.com/javase/9/tools/keytool.htm#JSWOR-GUID-5990A2E4-78E3-47B7-AE75-6D1826259549 (© 1993, 2007 Oracle, available at https://docs.oracle.com/, obtained on August 19, 2020).

 

Database Performance Analyzer

To enable certificate revocation checking in DPA, complete the following tasks. 

Task 1: Set the Java properties to configure revocation checking in DPA

1. To enable revocation checking, set the com.sun.net.ssl.checkRevocation property to true:
   1. Open the following file in a text editor:
      <DPA_home>\iwc\tomcat\ignite_config\idc\server.properties
   2. If DPA is running on Linux or on Windows using startup.bat, modify the following line:
      additionalJVMOption=com.sun.net.ssl.checkRevocation=true
   3. If DPA is running as a Windows service, modify the following line:
      windows.service.additionalJVMOption=com.sun.net.ssl.checkRevocation=true
2. To enable the use of OCSP for revocation checking, do the following:
   1. Open the following file in a text editor:
      <DPA_home>\iwc\jre\conf\security\java.security
   2. Add the following line:
      ocsp.enable=true

      NOTE: This setting will be overwritten after a Java upgrade.

Task 2: Enable revocation checking for each connection type in your deployment

For database instances that you have already registered, you can update the connection information for the instance.

Oracle monitored database instance registration

1. On the Enter Monitored Database Instance Connection Information panel of the registration wizard, choose the "TNS Connect Descriptor” option.
2. Specify the TCPS protocol in the TNS descriptor.
3. Click Advanced Connection Properties.
4. In the Connection Properties section, enter the following to cause Oracle to respect the DPA Trust Store:
   javax.net.ssl.trustStore=<DPA_install_dir>\iwc\tomcat\ignite_config\security\dpa-truststore.jks; 
   javax.net.ssl.trustStorePassword=changeit; 
   javax.net.ssl.trustStoreType=JKS

SQL Server (jTDS driver) monitored instance registration

1. On the Enter Monitored Database Instance Connection Information panel of the registration wizard, click Advanced Connection Properties.
2. Add the following property to both the JDBC and Connection Properties sections:
   ssl=authenticate

Azure (Microsoft driver) monitored instance registration

1. On the Enter Monitored Database Instance Connection Information panel of the registration wizard, click Advanced Connection Properties.
2. Add the following string to the Connection Properties sections (change the the azure domain to yours):
   encrypt=true;trustServerCertificate=false;hostNameInCertificate=*.your.azure.domain.net

PostgreSQL monitored instance registration

1. On the Connection Information panel of the registration wizard, under SSL mode, select Verify-Full.

You do not need to specify any additional properties. If the root CA is already trusted, then you will not be presented with a warning.

AD/LDAP Wizard

1. On the Connection Information panel of the registration wizard, under Port, select SSL.

Email Server Setup

No additional settings are needed.