Updating the Common Services certificates

Ops Center Installation and Configuration Guide
Version
11.0.x
Audience
anonymous
Part Number
MK-99OPS001-23
Common Services certificates are automatically updated to prevent revocation due to expiration. When a certificate is automatically updated, you need to update the Common Services certificate registered on the AD FS server. There are two ways to update certificates: automatically or manually.

Automatically updating the Common Services certificates

To automatically update Common Services certificates, perform the following procedure. Use the Relying Party Trust Monitoring function of AD FS to ensure that Common Services metadata is updated automatically.
Note: After the certificate is automatically updated in Common Services, it might take up to 24 hours until the certificate is updated by the AD FS Monitoring function. Until it is updated, you will not be able to log in to the Hitachi Ops Center Portal as an identity provider user.

Verify that the following settings are configured:

  • If the Windows Server version is 2019 or earlier, verify that Common Services certificates are signed with ECDSA.
  • Verify that TLS 1.2 or higher is enabled in the .NET Framework settings of the AD FS server.
  1. Log in to the Hitachi Ops Center Portal as the sysadmin user or as a user who is a member of the opscenter-administrators group.
  2. From the navigation bar, click Manage users.
  3. In Asset type in the Users window, click Identity providers. In the target identity provider details window, check the value of SAML SP metadata URI.
  4. Log in to the AD FS server.
  5. Select Start > Windows Administrative Tools > AD FS Management.
  6. From the tree on the left side, select AD FS > Relying Party Trusts. In the middle pane, select the target Relying Party Trust, and then in the right pane, click Properties.
  7. In the properties window, select the Monitoring tab, and enter the value of SAML SP metadata URI that you checked in the identity provider details window of the Hitachi Ops Center Portal in Relying party's federation metadata URL.
  8. Click Test URL to confirm. If an error occurs, review the SSL/TLS settings of Windows.
  9. Select the check box for Monitoring relying party.
  10. Select the check box for Automatically update relying party.
  11. Click Apply.

Manually updating the Common Services certificates

To manually update Common Services certificates, perform the following procedure. If the date of the next update of the authentication key of Common Services is approaching, update the authentication key and the metadata. You can also change the update interval of the authentication key without actually updating the key.
  1. Log in to the Hitachi Ops Center Portal as the sysadmin user or as a user who is a member of the opscenter-administrators group.
  2. Select Settings > Authentication key.

    The Authentication key window appears.

  3. To change the update interval of the authentication key, change the value of Authentication Key update interval (days).

    The default value is 180 days (with a range of 90 to 3,650). From a security standpoint, we recommend 90-180 days.

  4. For Update Authentication key now, select Yes.

    If you want to change the update interval without updating the authentication key, select No.

  5. Click Submit.

    If you selected No for Update Authentication key now, skip the remaining.

  6. Export the metadata of Common Services.
    For details, see Exporting Common Services metadata.
  7. Log in to the AD FS server.
  8. Select Start > Windows Administrative Tools > AD FS Management.
  9. From the tree on the left side, select AD FS > Relying Party Trusts.
  10. In Relying Party Trusts, check the value of Identifier for the Common Services instance that is registered.
  11. Run the following command in PowerShell: 
    Update-AdfsRelyingPartyTrust -MetadataFile storage-location-of-the-metadata-file -TargetIdentifier ID-of-the-relying-party
    For ID-of-the-relying-party, specify the value of Identifier for Common Services (checked in the previous step).
    Example of running the command:
    Update-AdfsRelyingPartyTrust -MetadataFile metadata.xml -TargetIdentifier https://www.example.com:8443/auth/realms/opscenter

    For details on the command, see the AD FS documentation.