1. 技术文章
  2. WSO2 MDM configuration : certificate problems

WSO2 MDM configuration : certificate problems

由 柔情痞子 提交于 2019-12-02 05:37:41
Dilshan

Based on your older questions I assume you are trying to configure the Android management part. Most of the certificate related stuff in the document is associated with iOS. If you want to try out the Android configuration you can skip most of the parts in that. Simply skip the CA/RA generations.

When configuring Android, only place you need a keystore is to configure the Android agent app. You can find the step by step configuration at Android client configurations. In this link it has pointed to the iOS CA generation since this step is already followed if you configure both iOS and Android. Otherwise you just have to execute these commands.

openssl genrsa -out <CA PRIVATE KEY> 4096
For example: openssl genrsa -out ca_private.key 4096

openssl req -new -key <CA PRIVATE KEY> -out <CA CSR>
For example: openssl req -new -key ca_private.key -out ca.csr

openssl x509 -req -days <DAYS> -in <CA CSR> -signkey <CA PRIVATE KEY> -out <CA CRT> -extensions v3_ca
For example: openssl x509 -req -days 365 -in ca.csr -signkey ca_private.key -out ca.crt -extensions v3_ca

openssl rsa -in <CA PRIVATE KEY> -text > <CA PRIVATE PEM>
For example:  openssl rsa -in ca_private.key -text > ca_private.pem

openssl x509 -in <CA CRT> -out <CA CERT PEM>
For example: openssl x509 -in ca.crt -out ca_cert.pem

End of the following commands you should have a ca_cert.pem with you.

Now you need to export this ca file into pkcs12. Command is as follows.

 openssl pkcs12 -export -out ca.p12 -inkey ca_private.pem -in ca_cert.pem -name "cacert"

Now you get the ca.p12 file.

Just exectue following command to create a keystore file.

 keytool -importkeystore -srckeystore ca.p12 -srcstoretype PKCS12 -destkeystore wso2mobilemdm.jks

As mentioned in my other thread wso2-mdm-android-agent-issue you can either rename this to bks file format or you can use portecle to convert this to bks since Android expect you to make the keystore file in bouncycastle format. Then embed this bks as mentioned in the doc and recompile the Android agent code.

In order to start its better you clear everything and get a fresh WSO2 EMM zip file. Extract it and start from the scratch. From you log what I feel is your existing wso2carbon.jks is corrupted. When generating do not import your generated CA to it and use a new keystore file as I mentioned in the last step.

Hope this helps.

Try this,

First try connecting to the server with HTTP protocol. Simply change the SERVER_PORT to 9763 and SERVER_PROTOCOL to http:// in the CommonUtilities.java file in MDM Agent.

If it's successful, then check your BKS generation options, specially the host name. It is the only place where it can go wrong. Try above and let us know the result.

I struggled with this as well, but finally figured it out. I debugged the app, and found the BKS gets checked when you select the IP on the mobile device, and if it fails, it doesn't error out. This however mean the authentication is still not working, and you get the error when you input the next few screens before it even attempt to connect.To fix this, I did the following :-

  1. Prepare a separate folder. DO NOT CREATE THE CERTS YET!
  2. Copy the following files from your \repository\resources\security folder :-
    • client-truststore.jks
    • wso2carbon.jks
  3. Since the jks files are in the temp folder now, also ensure to back them up
  4. Run the above from Dilshan in order (use the examples, they work fine)
  5. When prompted to Country etc, for your "Common name", make those your server IP address on your test environment. This is very important.
  6. For the "Challenge password" after asking for "Common name" etc, leave it blank. Only on this one though!
  7. All other password prompts, enter wso2carbon for simplicity sake
  8. By following the above, the 3 JKS (A new one called wso2mobilemdm.jks is also present now) files will now be updated with the new certs. Copy them, and the *.p12 files back to \repository\resources\security

This takes care of the Server part. Just edit the mdm-config.xml under \repository\conf, and unlike the document, remember I made all the password uniform above to make it easier, so ensure they are set as wso2carbon. Ignore the iOS parts, juts the "Keystore section" needs to be completed.

Also, edit the sso-idp-config.xml, and change the ip addesses as needed.

Now, to the BKS. This part is just vaguely mentioned in the documents. Get bcprov-jdk15on-146.jar downloaded. Copy this to your current temp folder for simplicity sake. I tried the bcprov-jdk15on-150.jar but it didn't work for some reason.

Run this now within this folder (My Keytool path is messed up since I have multiple versions of Java running):-

"%JAVA_HOME%\bin\keytool" -importcert -trustcacerts -keystore emm_truststore.bks -storetype bks -storepass wso2carbon -file ca_cert.pem -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath ./bcprov-jdk15on-146.jar

This will now create the BKS file in the temp folder, with the other Certs. Copy this emm_truststore.bks now back to your agent folder under res/raw, overwriting it.

In the MDM project, also check for "public static String SENDER_ID =" in the config file when you change the IP address etc prior to exporting.

Clean the project, and rebuild it. Now you are ready to export. What I did was to copy the wso2mobilemdm.jks to the root of my android project, since it is already in the correct format to use. But you can export, and create a new key for this. Note, this is nothing to do with the BKS you created, this is to sign the apk to run on the device.

If you run this now it should work. You will see activity when you try to authenticate to the server.

标签
wso2
ssl-certificate
mdm
易学教程内所有资源均来自网络或用户发布的内容，如有违反法律规定的内容欢迎反馈！
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!