Pre-requisite:
Make sure that keytool is in your path: export PATH=$PATH:$JAVA_HOME/bin 


1. Generating SSL keys for Console/Controller communication over JMX

1.1. Generate key for JMX over SSL for the controller (in a file named jmxserver.keystore)

[emmanuel@neron demo]$ keytool -genkey -v -keyalg RSA -keystore jmxserver.keystore -dname "CN=Server, OU=sequoia, O=continuent, L=Grenoble, ST=Isere, C=FR"
Enter keystore password:  supersecret
Generating 1,024 bit RSA key pair and self-signed certificate (MD5WithRSA)
        for: CN=Server, OU=sequoia, O=continuent, L=Grenoble, ST=Isere, C=FR
Enter key password for <mykey>
        (RETURN if same as keystore password):  
[Storing jmxserver.keystore]


1.2. Generate key for JMX over SSL for the console (in a file named jmxclient.keystore)

[emmanuel@neron demo]$ keytool -genkey -v -keyalg RSA -keystore jmxclient.keystore -dname "CN=Client, OU=sequoi, O=continuent, L=Grenoble, ST=Isere, C=FR"
Enter keystore password:  supersecret
Generating 1,024 bit RSA key pair and self-signed certificate (MD5WithRSA)
        for: CN=Client, OU=sequoi, O=continuent, L=Grenoble, ST=Isere, C=FR
Enter key password for <mykey>
        (RETURN if same as keystore password):  
[Storing jmxclient.keystore]


1.3. Export public keys

[emmanuel@neron demo]$ keytool -export -rfc -keystore jmxserver.keystore -alias mykey -file jmxserver.public-key 
Enter keystore password:  supersecret
Certificate stored in file <jmxserver.public-key>
[emmanuel@neron demo]$ keytool -export -rfc -keystore jmxclient.keystore -alias mykey -file jmxclient.public-key 
Enter keystore password:  supersecret
Certificate stored in file <jmxclient.public-key>


1.4. Import client public key in server keystore

[emmanuel@neron demo]$ keytool -import -alias client -keystore jmxserver.keystore -file jmxclient.public-key 
Enter keystore password:  supersecret
Owner: CN=Client, OU=sequoi, O=continuent, L=Grenoble, ST=Isere, C=FR
Issuer: CN=Client, OU=sequoi, O=continuent, L=Grenoble, ST=Isere, C=FR
Serial number: 452ce667
Valid from: Wed Oct 11 14:41:11 CEST 2006 until: Tue Jan 09 13:41:11 CET 2007
Certificate fingerprints:
         MD5:  04:8E:FD:7F:9F:7A:FA:2F:DF:63:78:F8:66:7E:F3:18
         SHA1: A5:88:43:65:52:9D:3E:6A:5B:2B:6D:92:8C:C0:B2:32:7F:D3:5A:47
Trust this certificate? [no]:  yes
Certificate was added to keystore


1.5. Import server public key in client keystore

[emmanuel@neron demo]$ keytool -import -alias server -keystore jmxclient.keystore -file jmxserver.public-key 
Enter keystore password:  supersecret
Owner: CN=Server, OU=sequoia, O=continuent, L=Grenoble, ST=Isere, C=FR
Issuer: CN=Server, OU=sequoia, O=continuent, L=Grenoble, ST=Isere, C=FR
Serial number: 452ce639
Valid from: Wed Oct 11 14:40:25 CEST 2006 until: Tue Jan 09 13:40:25 CET 2007
Certificate fingerprints:
         MD5:  64:63:12:37:22:A8:13:20:19:1A:B5:CC:14:02:55:D6
         SHA1: 5B:3F:54:9F:A1:57:86:2D:B1:F1:AA:4B:30:35:DD:E2:A3:9C:83:63
Trust this certificate? [no]:  yes
Certificate was added to keystore


1.6. Using SSL from the Sequoia console

Export the following JVM options:
[emmanuel@neron demo]$ export JVM_OPTIONS="-Dsequoia.ssl.enabled=true -Djavax.net.ssl.keyStore=/tmp/sequoia/config/jmxclient.keystore -Djavax.net.ssl.keyStorePassword=supersecret"
[emmanuel@neron demo]$ bin/console.sh


2. Generating SSL keys for JDBC Driver/Controller communication

2.1. Generate key for JDBC over SSL for the controller (in a file named jdbcserver.keystore)

[emmanuel@neron demo]$ keytool -genkey -v -keyalg RSA -keystore jdbcserver.keystore -dname "CN=Server, OU=sequoia, O=continuent, L=Grenoble, ST=Isere, C=FR"
Enter keystore password:  serverpass
Generating 1,024 bit RSA key pair and self-signed certificate (MD5WithRSA)
        for: CN=Server, OU=sequoia, O=continuent, L=Grenoble, ST=Isere, C=FR
Enter key password for <mykey>
        (RETURN if same as keystore password):  
[Storing jdbcserver.keystore]


2.2. Generate key for JDBC over SSL for the driver (in a file named jdbcclient.keystore)

[emmanuel@neron demo]$ keytool -genkey -v -keyalg RSA -keystore jdbcclient.keystore -dname "CN=Client, OU=sequoi, O=continuent, L=Grenoble, ST=Isere, C=FR"
Enter keystore password:  supersecret
Generating 1,024 bit RSA key pair and self-signed certificate (MD5WithRSA)
        for: CN=Client, OU=sequoi, O=continuent, L=Grenoble, ST=Isere, C=FR
Enter key password for <mykey>
        (RETURN if same as keystore password):  
[Storing jdbcclient.keystore]


2.3. Export public keys

[emmanuel@neron demo]$ keytool -export -rfc -keystore jdbcserver.keystore -alias mykey -file jdbcserver.public-key 
Enter keystore password:  serverpass
Certificate stored in file <jdbcserver.public-key>
[emmanuel@neron demo]$ keytool -export -rfc -keystore jdbcclient.keystore -alias mykey -file jdbcclient.public-key 
Enter keystore password:  clientpass
Certificate stored in file <jdbcclient.public-key>


2.4. Import client public key in server keystore

[emmanuel@neron demo]$ keytool -import -alias client -keystore jdbcserver.keystore -file jdbcclient.public-key 
Enter keystore password:  serverpass
Owner: CN=Client, OU=sequoi, O=continuent, L=Grenoble, ST=Isere, C=FR
Issuer: CN=Client, OU=sequoi, O=continuent, L=Grenoble, ST=Isere, C=FR
Serial number: 452ce8bb
Valid from: Wed Oct 11 14:51:07 CEST 2006 until: Tue Jan 09 13:51:07 CET 2007
Certificate fingerprints:
         MD5:  01:08:68:E3:31:2C:ED:19:02:D3:8E:A5:D6:D9:17:CD
         SHA1: 70:4F:FA:78:9F:CA:33:02:72:DF:C2:01:D0:1A:27:9E:B5:0A:56:9E
Trust this certificate? [no]:  yes
Certificate was added to keystore


2.5. Import server public key in client keystore

[emmanuel@neron demo]$ keytool -import -alias server -keystore jdbcclient.keystore -file jdbcserver.public-key
Enter keystore password:  clientpass
Owner: CN=Server, OU=sequoia, O=continuent, L=Grenoble, ST=Isere, C=FR
Issuer: CN=Server, OU=sequoia, O=continuent, L=Grenoble, ST=Isere, C=FR
Serial number: 452ce896
Valid from: Wed Oct 11 14:50:30 CEST 2006 until: Tue Jan 09 13:50:30 CET 2007
Certificate fingerprints:
         MD5:  D5:38:04:A2:23:11:18:F1:03:91:FE:D3:60:40:44:4D
         SHA1: 74:F1:D8:5E:B6:F0:C3:3F:32:CF:26:B5:A4:C2:17:2C:86:F2:B7:F8
Trust this certificate? [no]:  yes
Certificate was added to keystore


2.6. Using SSL from a JDBC client

In the client application make sure you use the following URL options:
jdbc:sequoia://localhost/myDB?ssl=true;sslKeyStore=/tmp/sequoia/config/jdbcclient.keystore;sslKeyStorePassword=clientpass
