Importing Self-Signed Certificates into Library/Web Pods in CMC environments

This article explains how to install and trust a self-signed certificate in the Library/Web pod using Tomcat in CMC environments. This can be useful if customer has a Private OIDC endpoint with self signed certificate.

Introduction

This article outlines the required steps to set up and trust a self-signed certificate on the Tomcat server running in the Library/Web pod of CMC environments.

Steps

1. Copy Certificate

Copy self-signed certificate file into the library pod’s persistent folder /data/library

Certificate file sample: /data/library/server.crt

2. Update Environment Script

This step applies to Library/BIWeb/Mobile services.

Update /data/library/tomcat/bin/setenv.sh, append the following code at the end.

cp $JAVA_HOME/lib/security/cacerts /usr/local/tomcat/conf/truststore.jks

keytool -importcert -trustcacerts -alias myrootca -file /data/library/server.crt -keystore /usr/local/tomcat/conf/truststore.jks -storepass changeit -noprompt

export CATALINA_OPTS="$CATALINA_OPTS -Djavax.net.ssl.trustStore=/usr/local/tomcat/conf/truststore.jks -Djavax.net.ssl.trustStorePassword=changeit"

For the Library pod only, in addition, the certificate should also be imported into the /WEB-INF/classes/auth/trusted.jks

Update /data/library/tomcat/bin/setenv.sh, append the following code at the end.

keytool -importcert -trustcacerts -alias myrootca -file /data/library/server.crt -keystore /WEB-INF/classes/auth/trusted.jks -storepass

$(awk -F"'" '/TRUSTSTORE_PASSPHRASE/ {print $2}' /home/mstr/mstr-bootstrap/library-bootstrap/utils/confUtils.js) -noprompt

3. Verification

Verify Tomcat Truststore for Library/BIWeb/Mobile services.

keytool -list -v -keystore /usr/local/tomcat/conf/truststore.jks -storepass 'changeit' -alias myrootca

For the Library pod only: Verify Library Truststore.

keytool -list -v -keystore /WEB-INF/classes/auth/trusted.jks -storepass $(awk -F"'" '/TRUSTSTORE_PASSPHRASE/ {print $2}' /home/mstr/mstr-bootstrap/library-bootstrap/utils/confUtils.js) -alias myrootca

4. Restart Pod

Restart library pod for this to take effect.

Notes:

Replace changeit with your actual keystore password if different.
Ensure /data/library/server.crt exists before updating the script.
The Library truststore password is dynamically retrieved from:

/home/mstr/mstr-bootstrap/library-bootstrap/utils/confUtils.js → TRUSTSTORE_PASSPHRASE

Comment

0 comments

Details

Knowledge Article

Published:

June 30, 2026

Last Updated:

July 1, 2026