KB479754: How to Update SSL Certificates for MicroStrategy

While SSL traffic for HTTP/HTTPS services (i.e. Strategy Web) is terminated on the Elastic Load Balancer in MSTR on AWS, traffic that relies on TCP passthrough (such as the Usher IDM and Collaboration Server) need valid SSL certificates on the EC2 instance itself. These certificates come pre-installed, but in the event that they expire, the following is a guide to replacing them. 

Step 1: Add Certificates to the AWS Account 

• Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
  
• On the navigation pane, under LOAD BALANCING, choose Load Balancers.
  
• Select the load balancer. For the environments deployed via the MCP console, type env- and search for loadbalancer.
  

• On the Listeners tab, for SSL Certificate, choose View/edit certificates.
  
• Click on the + sign at the top of the screen and click on Import Certificate.
  
• Select IAM (Please do not use ACM).
  
• The Certificate name needs to be: wildcardTrialCloud2022.
  
• In the Certificate Private Key, add contents from server.key.
  
• In the Certificate body, add contents from server.crt.
  
• In the Certificate chain, add contents from intermediate.crt.
  
• Click Import.
   
  

Step 2: Edit the Listener to use the new certificates

• Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
  
• On the navigation pane, under LOAD BALANCING, choose Load Balancers.
  
• Select the load balancer. For the environments deployed via the MCP console, type env- and search for loadbalancer.
  
• Select the Listener ID checkbox for the certificate that needs to be updated.
  
• Click Edit.
  

• Choose the newly added certificates.
  

• Once the certificates are updated, they will be visible on the console. 
  

• Keep the name of the certificates the same as the old certificates to avoid changing them manually in all files.
  
  If Usher is being used, please do the following:
  
• Delete the existing /opt/usher/ssl/server.key, /opt/usher/ssl/server.crt, /opt/usher/ssl/intermediate.crt 
  
• Download new files, with appropriate names, to /opt/usher/ssl
  
• Create a new Server CA by running cat /opt/usher/ssl/server.crt > /opt/usher/ssl/serverca.pem 
  
• Append remaining new certificates to Server CA by running cat /opt/usher/ssl/server.key /opt/usher/ssl/intermediate.crt /opt/usher/ssl/self-server.crt >> /opt/usher/ssl/serverca.pem
  
• Run cp -f /opt/usher/ssl/server.crt /opt/usher/usherserver/usherApps/shardIDM/webapps/files/saml2.crt
  

For the Collaboration Server. run the following: 

NOTE: These instructions apply to Strategy 10.9 and upwards, where the "Library" application was referred to as "StrategyLibrary". For older versions back to 10.6, this was named "StrategyConsumer"; replace references to that when appropriate.
 

1. Delete the existing Collab-Server keystore by running rm -rf /opt/mstr/MicroStrategy/install/CollaborationServer/keystore.pfx
   
2. Create a new keystore by running openssl pkcs12 -export -out /opt/mstr/MicroStrategy/install/CollaborationServer/keystore.pfx -inkey /opt/usher/ssl/self-server.key -in /opt/usher/ssl/self-server.crt -passout pass:changeit
   
3. Delete the existing Library keystore by running rm -rf /opt/apache/tomcat/latest/webapps/MicroStrategyLibrary/WEB-INF/truststore.pfx
   
4. Generate a new one by running keytool -noprompt -import -trustcacerts -alias collab-service -file /opt/usher/ssl/server.crt -file /opt/usher/ssl/intermediate.crt -keystore /opt/apache/tomcat/latest/webapps/MicroStrategyLibrary/WEB-INF/truststore.pfx
   
5. Delete the existing rest server keystore by running /opt/usher/ssl/keystore.jks
   
6. Generate the new rest server keystore by running keytool -noprompt -genkey -keyalg RSA -alias adminrest -keystore /opt/usher/ssl/keystore.jks -validity 3600 -keysize 2048 -dname  \"CN=StrategyCloud, OU=Cloud, O=Strategy, L=Tysons, S=VA, C=US\" -storepass changeit -keypass changeit
   
7. Add the Rest Server cert to the Rest Server keystore by running keytool -noprompt -export -keystore /opt/usher/ssl/keystore.jks -storepass changeit -alias adminrest -file /opt/usher/ssl/adminrest.crt
   
8. See if the Java keystore has the Rest Server cert by running keytool -list -keystore /opt/jdk/java/jre/lib/security/cacerts -storepass changeit -alias adminrest; if it DOES have it, run keytool -noprompt -delete -alias adminrest -keystore /opt/jdk/java/jre/lib/security/cacerts -storepass changeit
   
9. Add the Rest Server cert to the Java keystore by running keytool -noprompt -import -trustcacerts -alias adminrest -file /opt/usher/ssl/adminrest.crt
   
10. Set the Java keystore by running keytool -noprompt -import -trustcacerts -alias adminrest -file /opt/usher/ssl/adminrest.crt -keystore /opt/jdk/java/jre/lib/security/cacerts -storepass changeit