How do I enable SSL in AM (All versions) for an existing installation?
The purpose of this article is to provide information on enabling SSL in AM for an existing installation. It assumes you have already enabled SSL on your web application container and the truststore used by the JVM running AM has the necessary certificates installed.
1 reader recommends this article
Enabling SSL for an existing installation
Note
If this is an existing install, you can enable SSL as described in this article. If it is a new install, it is preferable to reinstall AM rather than making lots of configuration changes as described in How do I enable SSL in AM (All versions) post-install?
To enable SSL:
- Enable SSL on your web application container per your vendor's instructions. Ensure the truststore used by the JVM running AM has the necessary certificates installed. See How do I import a certificate into the truststore used by AM (All versions) for SSL? for further information.
- Take a backup of your configuration data to ensure you have it for reference or in case you want to restore your current configuration. See Maintenance Guide › Backing Up Configurations (AM 7 and later) or How do I make a backup of configuration data in AM 5.x or 6.x?
- Log into the console as the admin user (typically amAdmin).
- Clone the server configuration by navigating to: Deployment > Servers and selecting the vertical ellipsis > Clone on the AM instance you want to change to an SSL enabled installation.
- Enter the new server URL in the Server URL field using the https protocol instead of http and changing the port as appropriate. For example, if your existing server URL was: http://host1.example.com:8080/openam, you would change it to something similar to: https://host1.example.com:8443/openam
- Update the Realm DNS alias in the top level realm if the hostname has changed by navigating to: Realms > Top Level Realm / > Properties > Realm/DNS Aliases in the console.
- Update the cookie domain if the hostname domain has changed by navigating to: Configure > Global Services > Platform > Cookie Domains.
- Logout of the console.
- Edit the bootstrap file to point to the new server. This is the boot.json file, which is located in the /path/to/openam/config directory (AM 7 and later) or the /path/to/openam directory (Pre-AM 7).
- Restart the web application container in which AM runs.
- Navigate to the new server URL that you specified in step 5 to ensure it works as expected.
- If the new server is operational, remove the old server and Realm DNS alias associated with the old hostname (if different).
Note
Once you have enabled SSL in AM, you should include details of the truststore that contains the required certificates in the setup or setup.bat script prior to installing ssoadm and in the ssoadm or ssoadm.bat script once it is installed. This is described in FAQ: Installing and using ssoadm in AM (Q. How do I install the ssoadm administration tool if I am using SSL?).
See Also
How do I enable SSL in AM (All versions) post-install?
FAQ: SSL/TLS secured connections in AM and Agents
How do I make AM 5.x and 6.x communicate with a secured LDAP server?
Related Training
N/A
Related Issue Tracker IDs
N/A