Maximo SSL (HTTPS) Configuration

Kim W·December 23, 2016·24 comments

I won’t get into a lengthy discussion about why you should use SSL to secure browser traffic. I’ll simply offer that your Maximo environment, especially if the environment can be accessed over the public internet, should be secured. Here are a few reasons:

  • SSL Encrypts Sensitive Information
  • SSL Provides Trust and Authentication
  • SSL Can Provide Compliance in certain Industries

The disadvantages are that it costs money to obtain and verify a certificate from a Certificate Authority, and it takes some time to configure. Hopefully, this blog post will help to reduce the amount of time necessary to configure SSL with Maximo.

Please note that you can also create a self-signed certificate which will suffice in forcing the browser traffic to be encrypted. However, users will see that the certificate is not trusted in the browser, and it might lead them to ask questions or not trust the connection.

This article will take you through setting up Maximo with SSL through a GoDaddy SSL Certificate, which is currently ranging anywhere from $50.00 to $300.00 annually based on the level of encryption, features, and number of sub-domains you want to secure. We will use the most basic single-domain option for this exercise.

Step 1: Create a Key Database and Generate a new Certificate Signing Request

Run the IBM Key Management Utility

  • Sign on to the server where the IBM HTTP Server is installed as an administrator.
  • Run the IBM Key Management Utility program from your Start Menu > IBM HTTP Server V8.5

Create a Key Database

  • Create a new Key Database File. This file will hold your private keys and must be kept secure:
    • Key database type: CMS
    • File Name: maximo.kdb
    • Location: C:\IBM\HTTPServer\ (provide an appropriate path for your system)
    • Click OK

Secure the Key Database

  • You will be prompted for a password to secure your new key database:
    • Enter a password
    • Confirm the password
    • Check the Stash password to a file checkbox
    • Click OK

Create a New Certificate Signing Request

  • Create a New Certificate Request from the menu options. This request, also known as a Certificate Signing Request (CSR), is what will be sent to the Certificate Authority for verification. With the information provided in the request, the CA will do their homework on you to make sure you are who you say you are, including possibly attempting to contact you or your business by email or phone. It’s important that this information is as accurate as possible:
    • Key Label: MAX_SSL_KEY
    • Key Size: 2048
    • Common Name: www.mycompany.com (this is the host name that you want to secure and must be correct!)
    • Organization: My Company Inc
    • Locality: Your city
    • State/Province: Your state
    • Zipcode: Your zip
    • Country or region: Your country
    • Email Address: admin@mycompany.com
    • Enter the file name: C:\IBM\HTTPServer\maximo.arm
    • Click OK. We’re going to leave the IBM Key Management Utility open for now. We’ll come back to it later.

Step 2: Purchase an SSL Certificate, Upload the CSR, and Download the Certificate

Purchase an SSL Certificate

Request an SSL certificate

After you purchase an SSL certificate, you need to request it for the website’s domain name (or “common name”) you want to use.

Activate your credit

  1. Log in to your GoDaddy account.
  2. Click SSL Certificates.
  3. Next to the SSL certificate credit you want to use, click Set up.
  4. If you have multiple credits, select the credit you want to use, and then click Set up.
  5. Refresh the page; you should see a New Certificate. If you don’t, continue to refresh the page until you do.

Request your certificate

  1. Next to your New Certificate, click Manage.
  2. Select Provide a CSR, and then enter the CSR from your server. Back on the server where the IBM HTTP Server is installed, open the C:\IBM\HTTPServer\maximo.arm file in your favorite text editor. Copy its contents. This is your Certificate Signing Request (CSR).
  3. Click Request Certificate.

Verification Process

  • GoDaddy will verify your certificate request. How long this takes depends on the type of certificate (typically between 1 and 7 days). Once we have that certificate we can continue with the process. Until then, we wait.

Download the Certificate

  • After GoDaddy approves your SSL certificate request, you can download your primary and intermediate certificate from within the SSL application on the GoDaddy website.
  • On your SSL certificate home page, click Download.
  • Select the Apache server type.
  • Click Download ZIP file.

Copy the Certificate to your IBM HTTP Server

  • Copy the ZIP file to the C:\IBM\HTTPServer\ folder on the server where the IBM HTTP Server is installed.
  • Extract the contents of the ZIP file to the C:\IBM\HTTPServer\ folder.
  • Note that there should be two files: one that represents your certificate, and one that represents GoDaddy’s intermediate certificate. You will need both to install the certificate in the next step.

Step 3: Install the Certificate

Run the IBM Key Management Utility

  • Sign on to the server where the IBM HTTP Server is installed as an administrator.
  • Run the IBM Key Management Utility program from your Start Menu > IBM HTTP Server V8.5
  • Open your maximo.kdb key database created earlier, using the password you created earlier to unlock the key database.

Install the Intermediate Certificate

  • Change the Key database content drop-down to Signer Certificates.
  • Click the Add… button
  • Choose the intermediate certificate file that you extracted in the previous step. Please note that the file name is likely to be of the nature gd_bundle_*.crt, and that the CRT file extension is not in the default list in the Key Management Utility file browser. Simply change the file extension drop-down to All Files or paste the exact file name into the window.
  • Click OK
  • You should see the intermediate GoDaddy certificates listed.

Install the Certificate

  • Change the Key database content drop-down to Personal Certificates.
  • You should see the MAX_SSL_KEY record that was created earlier when we created our CSR. Highlight that record. Note that the * in front of the MAX_SSL_KEY record indicates it is the default key.
  • Press the Receive button.
  • Choose the certificate file that you extracted in the previous step. Please note that the file name is likely to be some has sequence with a file extension of .crt, and that the CRT file extension is not in the default list in the Key Management Utility file browser. Simply change the file extension drop-down to All Files or paste the exact file name into the window.
  • Click OK
  • If all goes well you should see a Validation Successful message in the Key Management Utility! This means that your key database is now validated with a signed certificate from a Certificate Authority (GoDaddy). We’re almost done!

Step 4: Update the HTTP Server, WebSphere, and Maximo

Update the IBM HTTP Server

  • Sign on to the server where the IBM HTTP Server is installed as an administrator.
  • Edit the C:\IBM\HTTPServer\conf\httpd.conf file. Please note that the directory path may be different based upon your installation (e.g. C:\Program Files\IBM\HTTPServer\).
  • Add the following snippet to the file: 
    # Maximo SSL Config
LoadModule ibm_ssl_module modules/mod_ibm_ssl.so
Listen 0.0.0.0:443
## IPv6 support:
#Listen [::]:443
<VirtualHost *:443>
SSLEnable
</VirtualHost>
KeyFile "C:/IBM/HTTPServer/maximo.kdb"
  • Save the file.
  • Restart the IBM HTTP Server V8.5 Windows Service.

Update the WebSphere Virtual Host

  • Log into the IBM WebSphere Console as an administrator.
  • Navigate to Environment > Virtual Hosts.
  • Click on the maximo_host Virtual Host.
  • Click on Host Aliases under Additional Properties.
  • Click on the New… button.
  • Add the host name that you used for the Common Name (e.g. www.mycompany.com) in your certificate request as the Host Name. Specify 443 as the Port.
  • Click OK and save the configuration to the Master File.
  • Restart your IBM WebSphere Windows Services (Cell Manager and Node Agent).

Update your Maximo System Properties

  • At this point, you should be able to access Maximo over SSL (HTTPS). There are just a few System Properties that should be updated in order to have everything buttoned up.
  • Log into Maximo as an administrator.
  • Navigate to the System Configuration > Platform Configuration > System Properties application.
  • Update the following properties, which should just involve changing the existing property value to change the http:// to https://
    • mxe.doclink.path01: This is for attached documents.
    • mxe.help.protocol: This is for application help. Please note that in 7.6.0.4 the help is now pointing to IBM’s website. In either case, the property value should be changed to https.
    • mxe.int.webappurl: This is for Integration Framework web service and HTTP calls.
    • mxe.oslc.restwebappurl: This is for OSLC calls through the REST interface.
    • mxe.oslc.webappurl: This is for OSLC calls through the standard interface.

 

That’s it! I hope this has been helpful. Please feel free to leave feedback in the comments section below.

 

Kim W

Related posts

24 comments

  • Courtney Carter
    5 years ago Reply

    Very helpful article that has helped us get our configuration secured as well. I wanted to go ahead and point out that if you prefer to work at a command line that you can use the IBM HTTP Server’s gskcapicmd command line tool to also do all these steps. Reference IBM Support article “Creating IHS keystores and certificate requests on the command line with gskcapicmd” located at https://www.ibm.com/support/pages/node/6253339

    —– example instructions for when you need to use a local CA ——

    cd /opt/IBM/HTTPServer

    bin/gskcapicmd -keydb -create -db conf/maximo.kdb -pw passw0rd -stash

    bin/gskcapicmd -certreq -create -db conf/maximo.kdb -stashed -dn “CN=www.mycompany.com, O=My Company Inc, L=New York, ST=NY, C=US” -label MAX_SSL_KEY -size 2048 -sigalg sha512WithRSA -san_dnsname http://www.mycompany.com -file conf/maximo.arm

    Request and download certificate from your own local CA

    bin/gskcapicmd -cert -add -db conf/maximo.kdb -stashed -file conf/localrootca.cer -label localrootca

    bin/gskcapicmd -cert -add -db conf/maximo.kdb -stashed -file conf/localsubca.cer -label localsubca

    bin/gskcapicmd -cert -receive -db conf/maximo.kdb -stashed -file conf/downloaded-certificate-from-local-ca.cer -default_cert enable

    bin/gskcapicmd -cert -validate -db conf/maximo.kdb -stashed -label MAX_SSL_KEY

  • Julio Hernandez
    6 years ago Reply

    Your article helped me get SSL working when accessing Maximo through the IBM HTTP Server. I was still getting “Not Secure” messages when accessing Maximo directly or accessing the WebSphere Console but IBM Support walked me through how to import the SSL certificates into WebSphere itself.

    One issue I found was with the Help application. I found that if mxe.help.protocol is changed to “https” then mxe.help.port needs to be changed from “80” to “443” to avoid errors when opening the IBM Knowledge Center.

    Thank you.

  • Julio Hernandez
    6 years ago Reply

    This article talks about the IBM HTTP Server. How is this different than generating a certificate for WebSphere itself and under what conditions do you do one vs. the other?

    When WebSphere is installed by the IBM Maximo Configuration Utilitiy, it creates a Web Server and an App Server. But Maximo runs fine with just an App Server. Is a Web Server needed to secure Maximo through SSL?

    Thank you.

    • kidmax49
      6 years ago Reply

      Dear Julio – Thanks for your comment. This was exactly my concern as well. I believe our Linux admin already installed a self-signed cert for WebSphere although Maximo runs on HTTP. Although our situation is slightly different, your situation is very helpful in coordinating with both IBM Maximo support and IBM WebSphere support it seems.

  • David Miller
    7 years ago Reply

    Have you thought about playing with how to setup SSL with Maximo linked to Cloudfare???

    trying to follow your above post and figure out where the PEM file and Private Key I get from Cloudfare would come in on setting up the Origin CA server (Maximo).

    Just curious,
    Miller

  • ThinkTank
    8 years ago Reply

    Hello,

    we need to call a secure webservice from Maximo using publish channel. Do I have to import certs in websphere?

    thanks

  • Gagan
    8 years ago Reply

    Hi Alex, Thanks for sharing such a useful article.

    Can you please help me with the below problem?

    I am getting invalid certificate when running a BIRT report.

    Maximo URL: https://maximo.xyz.ca/maximo
    This URL is also added to the UICluster Virtual host with port 443

    Reports birt viewer URL: https://maxrep.xyz.ca/maximo/report
    This URL is added to the BROSCluster Virtual Host with port 443

    The BROS application is mapped to the BROS JVM and webserver1.

    • Alex Walter
      8 years ago Reply

      Thanks!

      A certificate is usually only valid for a given domain name. In other words, you will need two certificates – one for maximo.xyz.ca and one for maxrep.xyz.ca. The exception is that some providers offer wildcard certificates, where one certificate can match *.xyz.ca.

      In your case you will need two certificates or one wildcard certificate to secure both maximo.xyz.ca and maxrep.xyz.ca. The setup above can be followed for both JVMs. Good luck!

      • Gagan
        8 years ago Reply

        Thanks for responding Alex!

        We are using wildcard certificate i.e. *.xyz.ca.

        I am able to get around the invalid certificate problem by deploying the BROS EAR to a webserver running on the same VM as BROS JVM. But this approach then allows users to login to maximo using the maxrep.xyz.ca url as well which I dont want to happen.

        Any thoughts?

  • Nadeem Bhatti
    8 years ago Reply

    Hi Alex,
    Is it possible to use wildcard SSL certificate with Maximo?

    • Alex Walter
      8 years ago Reply

      Yes, a wildcard certificate can be used with Maximo. Most of the SSL certificate providers will provide a way to specify your list of sub-domains for wildcard certificates. Other than providing the Maximo sub-domain to the provider, the steps should be very similar to what’s been listed in the article.

  • Venkat Srinivasan
    8 years ago Reply

    Hi Alex,

    A Big Thank you for making this concise instructions. Are there any special considerations for Maximo clustered environment in enabling SSL?

    • Alex Walter
      8 years ago Reply

      You’re welcome! For a clustered environment, the key is securing the load balancer URL and then ensuring that the Virtual Hosts are configured properly. You do not need certificates for each host within the cluster. You simply need to establish trust with the load balancer.

  • Jeff kidh
    9 years ago Reply

    Is there some way to encrypt the mxe.report.birt.viewer?

    • Alex Walter
      9 years ago Reply

      If you have a BIRT Reporting Only Server (BROS), you can secure that environment in a similar fashion. Then update your mxe.report.birt.viewerurl System Property to use the HTTPS protocol.

  • KM Simmons
    9 years ago Reply

    Your article is quite good. Do you think it is advisable in this situation to configure access such that ssl is the only/mandatory connection available?

  • Harold Morales
    9 years ago Reply

    Great article, very concise and informative. Do you have any further steps in order to only allow TLS 1.2 as the transport protocolo on SSL?

Michael Woline

Technology Project Manager (PMP 2009-18) with 15 plus years’ experience building, migrating, and upgrading enterprise applications including Maximo and Peoplesoft. Industries include banking, insurance, and publishing. Career began as a developer writing code and SQL because solving puzzles and figuring out how things works is fun. For fun I used to kite board on the beach, and have resumed cycling with a goal of riding some of the routes of the Giro d'Italia and Tour De France.

Nick Bonfiglio

Hi, I'm Nick! I am relatively new to Maximo, but I've been working in the software and IT space for a good stretch of my career. Most of that time I’ve spent as a QA Engineer at a SaaS company, so I'm no stranger to the technical side of things. Outside of work, I spend most of my time with family. I enjoy cooking and trying out new recipes whenever I get the chance, most of all I love cooking on a good grill! Living in Florida, I take full advantage of the beach as much as I can. I like to keep things pretty simple just good food, family, and some sun!

Akilah

Hi, I’m Akilah! I work with Maximo and come from a background in Computer Engineering, where I picked experience with SQL, Python, and general IT troubleshooting (aka figuring out why things break and how to fix them). I also served as a communications lead during my senior capstone, which helped me get comfortable collaborating with teams and keeping things moving.

Chad

Chad started his CMMS and EAM solutions consulting career in the late 20th century. The past twenty-three years have primarily been focused on supporting Maximo in Life Sciences, Oil & Gas, Government facilities, and Manufacturing verticals. Chad especially enjoys discussions regarding logistics, inventory management, and process improvement. In his free time, he enjoys hunting, fishing, playing guitar, maintaining his small farm, and spending time with his family.

Mike

Mike is a jack-of-all-trades IT professional with 20+ years in manufacturing, starting as a Help Desk temp and working his way through admin, engineering, management, and architect roles. He loves solving problems and building tools to make work easier—Maximo gives him plenty of chances to do both. In his free time, Mike enjoys woodworking, the outdoors, playing synths and hand drums, reading, and learning. Given his druthers (whatever those are), he'd build a timber-framed cabin on 40+ acres of mixed hardwood forest for his future grandkids to work for free play in.

Shane

Maximo Analyst

With a background in Computer Science and Cybersecurity and a CompTIA Security+ certification, I bring both a technical foundation and a curiosity-driven mindset to everything I do. Since joining the industry, I’ve gained hands-on experience with IBM Maximo, including scripting, BIRT reporting, Maximo customization, configuration, and supporting long-term client projects. I've also attained my MAS8 certification. I’ve had the opportunity to work closely with clients, troubleshoot complex issues, and contribute to impactful system enhancements—all while continuously learning and growing in the field. I approach challenges with determination, thrive in collaborative environments, and enjoy finding creative solutions. Outside of work, I recharge by spending time with family and friends, playing video games, staying active, and experimenting in the kitchen.

Maximo Application Suite

Accelerated Time to Value
Lower Total Cost of Ownership
Scalable, Integrated Platform
Continuous Innovation & Updates

Visual Inspection

Accelerate Defect Detection
Flexibility to Train and Deploy
Increase Uptime 24/7 Real Time Monitoring
Better Worker Safety

Monitor

Enterprise Level Data Aggregation
Scaled Operations
AI Deductions
Advanced Root Cause Analysis

Predict

Condition Based Maintenance
Lower Costs
Better Asset Availability
Reduced Risk

Manage

Comprehensive View of Assets
Understand Resource Attributes, Configuration and Relationships
Drill Down View

Health

Improve Reliability
Performance Insight
Better Planning
Clean Data
Optimization – Data, Costs, Risks

Mobility

Boost Productivity
Safer Workplace
Reduce Knowledge Gaps
Avoid Downtime

Maximo Assist

AI-Powered Troubleshooting & Guidance
Faster Issue Resolution in the Field
Knowledge Capture & Reuse Across Teams
Smarter Decisions with Contextual Insights

Dexter

Maximo Analyst

Dexter began his career in the warehouse field. Developing his skills in inventory control, accounts payable, shipping, and receiving, and procurement. While working at Apex he was learning the Maximo system in and out. Eventually learning it so well he taught everyone how to use it. Eventually becoming a system administrator for the Apex site.

A fun fact about Dexter is that he was an Elvis impersonator for 24 years. He enjoys singing, fishing, golf, and playing pool. He's an avid movie buff, most likely you'll find him watching the latest movie.

Chip

Client Relations Specialist

Chip is new to Maximo but has worked for various software companies through his career in both a sales and client relations role. In his spare time, Chip likes to golf, travel and work on projects around the house, especially those with an artistic touch. He is also up for any type of competition whether that be playing cards, board games or recreational sports.

Sarah

Maximo Analyst

Sarah is a recent graduate starting her asset management career. She counts fast learning and determination as key skills that she’s applying to become an Maximo pro! Sarah’s background in IT Services and studies in computer science have strengthened her natural problem-solving skills and desire to help others through technology. In her free time, Sarah enjoys baking, sewing, reading comic books, and building her own video game.

Vishal

Maximo Analyst

Hey there! I’m a Maximo Developer with hands-on experience working across IBM Maximo 7.5.x, 7.6.x, MAS 8, and MAS 9. My focus is mainly on database administration, system integrations, automation scripting, UI customizations, and Maximo admin tasks like BIRT reporting and migration management. I’ve also dabbled in integration work and enjoy finding smart, efficient solutions to everyday challenges in Maximo.

When I’m not working, you’ll probably find me gaming on my PS5 over the weekend or exploring the latest tech trends to keep myself up to speed.

Xavier Galarza

Maximo Analyst

I'm a motivated and curious professional with hands-on experience across multiple Maximo projects, including leading several initiatives. My goal is to continue deepening my expertise in Maximo so I can guide others in unlocking its full potential. I am also fully certified in MAS8. With a strong background in development and a natural problem-solving mindset, I enjoy tackling challenges and learning from those around me. I'm passionate about continuous improvement—both technically and personally—and thrive when I'm surrounded by talented, knowledgeable peers. Outside of work, I enjoy playing video games, watching sports, and staying active with pickleball.

Courtney LeBlanc

Business Analyst

Courtney is a polished Maximo consultant with over 10 years working in the industry. She has worn many hats including QA Specialist, Trainer, Functional Lead, Project Lead and Business Analyst. A point of great professional pride for Courtney is helping clients meet their needs and realize the power of their investment. Being a part of the process that helps clients learn how to use their system and get the most out of it is a great feeling at the end of the day.

Bob Richardson

VP of Products (Ninja)

Bob leads A3J Group’s operational services and heads up our Maximo Ninja product line. With over 50 successful Maximo projects under his belt and MAS 8 certifications in both functional and technical tracks, Bob brings deep experience and steady leadership to every engagement. He has played a key role in the development of many of A3J Group’s most advanced solutions.
Outside of work, Bob enjoys traveling with his wife, spending time outdoors, and occasionally pondering life’s mysteries from his garage—possibly while thinking about squirrels.

Kelly Nimmo

VP of Products (MxMobile)

Kelly Nimmo leads A3J Group’s product development and serves as a senior analyst and consultant with over 14 years of IBM Maximo experience. She is a co-architect and lead developer of MxMobile, our flagship mobile solution, and holds MAS 8 certifications in both functional and technical disciplines. Known for blending technical depth with practical insight, Kelly plays a key role in designing and delivering innovative Maximo-based tools. Outside of work, she enjoys fishing the Florida waters and teaching soccer skills—like the “around the world”—to her nieces and nephews.

Kim Walter

COO

Kim began her career in Investment Banking in the Biotech and Tech sectors. After leaving banking, she focused on executive strategic development evolving her business building skills. Co-founding A3J Group was a natural fit with the idea of creating a fierce ninja style unit that outperforms all others. In her free time, she is training for her next eventing competition or studying to become a Master of Wine or practicing her tornado kick. She could be with her family hiking or surfing or cooking. But she’s definitely not sitting around doing nothing.

Alex Walter

CIO

Alex brings 18 years of Maximo/EAM consulting experience in Life Sciences, Oil & Gas, Water/Waste Management, Government facilities, and much more. He has been awarded the honor of IBM Champion from 2018-2021, and is the brainchild behind our revolutionary mobile solution MxMobile.

In his free time he buys camping gear, enjoys a good circular saw and spends time with his family hiking, surfing and being outdoors.

Enhancement

• Configuration
• Integration & data loading
• Report improvement
• Screen view & workflow changes

Sustainability

• Report
• Troubleshoot
• Learn
• Teach
• Lead

Change Management

• Advanced systematic improvements
• Tailored procedure implementation
• Script-, report-, and application-level source and document control through Git repository software
• Training on how to document and deploy changes

Monitoring

• Active monitoring of your IBM Maximo system’s heartbeat
• Triggered notifications and support tickets when Maximo is not responding
• Automated Escalations based on the health of various critical background processes.
• Periodic and quarterly scheduled system health checks

System Support & Trouble Shooting

•On Demand Support
•Advanced Troubleshooting
•Access to A3J Group’s Maximo Support Environment to submit trouble tickets
•Directly report bugs, request fixes and enhancements

System Patching & Environment Refreshes

• Tentative, bi-annual feature pack releases from IBM
• Minor patches (defined by the last number in the version model)
,• Quarterly lower environment refreshes

Admin

MxAsk

Create new self-service requests in a wizard-style format, and view the details of their open service requests.

MxApprove

Accept, reject, and reassign assignments, review assigned records, and view your workflow inbox.

MxMobile

A suite of mobile applications designed to integrate with IBM Maximo Asset Management. These apps modernize workflow, expedite inventory processes, reduce time spent on data entry, and more.

Workflow

MxMeter

View and enter meter readings, view trends in graphical format, and create readings while in offline mode.

MxAsset

Scan barcodes and view maintenance facts. Create meter readings, work orders or service requests. Toggle asset downtime.

MxWork

Create new work orders on the go, view existing work orders and attachments, and capture fingertip electronic signatures.
0