Configure the Java Agent for FIPS Compliance

  1. Rename the existing secure credential keystore file.
  2. Initialize a new secure credential keystore using the Secure Credential Store (SCS) utility.
    The SCS utility is available at: <javaagent_home>/verX.X.X.X/utils/scs/scs-tool.jar.
  3. Run the Secure Credential Store utility generate_ks command with the following parameters:
    • filename: Absolute path where the utility will create the secure credential keystore. Use this path for <credential-store-filename> in agent configuration.
    • storepass: The secure credential keystore password. Use the obfuscated version of this password as the value for <credential-store-password> in agent configuration.
    • format (For FIPS-compliant users only): The format of the secure credential keystore.
    Example command: 
    java -jar scs-tool.jar generate_ks -filename '<>/secretKeyStoreFIPS' -storepass 'MyCredentialStorePassword' -format FIPS

    The Secure Credential Store utility confirms the creation and initialization of the keystore.

    Expected output:

    Successfully created and initialized new KeyStore file: /opt/appdynamics/secretKeyStore
Verification - New KeyStore file: /opt/appdynamics/secretKeyStoreFIPS is properly initialized.
  4. Run the following command to obfuscate the plain text password. 
    java -jar scs-tool.jar obfuscate -plaintext 'MyCredentialStorePassword'
    The output is an encrypted string that looks like s_-001-12-5pA2yIp3rZY=zIgMiWjtFhMRAtpN4FI6U12PRVghqTpnFHmTN7Rh6HY=.
  5. Run the following command using the obfuscated password from Step 4 to encrypt the actual Controller account access key. 
    java -jar scs-tool.jar encrypt -filename '<>/secretKeyStoreFIPS’  -storepass ’<output_from_step_above>‘ -plaintext '<controller_account_access_key>' -format FIPS
    The output is an encrypted string that looks like -001-24-mEE2dy63UbE/u93idMxfew==JZgvmqT/+OddN+sLH43mx145FNoducIM44qeYczBnc5tbUoay3x8qc/Z3pDlGC4C
  6. Modify the controller.xml file using the outputs of Step 4 and Step 5.
    The following is an example of the controller.xml file. 
    <controller-info>
<controller-host><controller_url></controller-host>
<controller-port><port></controller-port>
<controller-ssl-enabled><true/false></controller-ssl-enabled>
<enable-orchestration>false</enable-orchestration>
<use-simple-hostname>false</use-simple-hostname>
<use-encrypted-credentials>true</use-encrypted-credentials>
<!-- Full qualified path name for the SCS-KeyStore file name. -->
<credential-store-filename><path</secretKeyStoreFIPS</credential-store-filename>
<!-- Password for the 'Secure Credential Store' (SCS). This password must be obfuscated. -->
<credential-store-password><obfuscated_password></credential-store-password>
<credential-store-format>FIPS</credential-store-format>
.
.
.
This account-access-key must be encrypted if 'use-encrypted-credentials' is set to true -->
<account-access-key><encrypted_account_access_key></account-access-key>