Metacat

which is accessed at the following URL::

   http://somehost.somelocation.edu/context/style/skins/dev/replControl.html

Also note that you must SCP partner certificates to your machine; you cannot 

use the "Download Certificate from" option on the Control Panel. For more 

information about creating and installing certificates, please see Generating 

and Exchanging Security Certificates.

The certificates will be exchanged so that each machine understands that the 

other has replication access.

The process for generating certificates is different for Metacat servlets 

running under Tomcat and those under Tomcat/Apache (the recommended configuration). 

For instructions on generating and exchanging certificates on systems running 

only Tomcat (and Java 6), see Generating a Certificate for Tomcat standalone 

(no Apache).

1. Generate a certificate key using openssl. The key will be named 

   came from. 

3. Enter the certificate into Apache's security configuration. You must 

4. Apache needs to know about Metacat SSL. The helper file named "knb-ssl" has 

   rules that tell Apache which traffic to route to the Metacat SSL port. Set up 

   SSL by dropping the knb-ssl file into the sites-available directory and 

   running ``a2ensite`` to enable the site: 

6. SCP ``<hostname>-apache.crt`` to the replication partner machine.

Generating a Certificate for Tomcat standalone (no Apache)

..........................................................

If you are running Metacat under Tomcat (no Apache), generate keys in the Java 

default key store.  The generated key is placed into the binary certificate's 

file located at ``/etc/java-1.5.0-sun/security/cacerts``.

1. Generate the key by running the following command (note that you must be 

   logged in as the root user to use the keytool):

   ::

     keytool -genkey -alias <aliasname> -keyalg RSA -validity 800 -keystore /etc/java-1.6.0-sun/security/cacerts

   ``<aliasname>`` is a unique name that you choose for this key. Something 

   like "<hostname-tomcat>" might be appropriate, where ``<hostname-tomcat>`` 

   is the name of the Metacat host. 

2. The Password-keytool will ask for a password. If writing to a pre-existing 

   keystore, you must know the password. If you are creating a new keystore, 

   the password you enter will become the keystore password. 

   Sample values when creating certificate: 

   ::

     What is your first and last name? myserver.nceas.ucsb.edu (note: use the host name without port number) 

     What is the name of your organizional unit? NCEAS 

     What is the name of your organizional unit? UCSB 

     What is the name of your City or Locality? Santa Barbara 

     What is the name of your State or Province? California (note: this is spelled in full) 

     What is the two-letter country code for this unit? US 

3. Create a certificate by running the command:

   ::

     keytool -export -alias <aliasname> -file <outputfile>.cert -keystore /etc/java-1.6.0-sun/security/cacerts

   ``<aliasname>`` is the same name you used when you created the key file. A 

   file named ``<outputfile>.cert`` will be created in the directory from which 

   you ran the keytool command. You can name the output file anything you like, 

   but keep in mind that it will be sent to the partner machine used for 

   replication. The filename should have enough meaning that someone who sees 

   it on that machine can figure out where it came from. Again, something like 

   "<hostname>-tomcat.cert" will suffice. 

4. Edit the Tomcat server file at ``$TOMCAT_HOME/conf/server.xml`` to enable 

   SSL in Tomcat.

   * Uncomment the section that starts with "<Connector port="8443" ...

     (Note: Databased Information comments start with <!-- and end with -->). 

   * Add two attribute to that section: 

     ::

       keystoreFile="/etc/java-1.6.0-sun/security/cacerts"

       keystorePass="<keystore_password>"

     where ``<keystore_password>`` is the password you used when you created 

     or accessed the keystore. 

5. SCP the certificate to the partner server.

1. Log in as a root user (the keytool must run as a root user)

     sudo su –

2. Import the remote certificate by running: 

     keytool -import -alias <remotehostalias> -file <remotehostfilename>.crt -keystore /etc/java-1.6.0-sun/security/cacerts

   The ``<remotehostalias>`` is the name the certificate will use in the 

   keystore. The name should identify the remote host. 

or use the local machine as a hub). Note that you cannot download certificates 

using this interface.