The SSO Management API and Password Reset connect to the SSO OAuth 2.0 endpoints, so the server certificate of those endpoints must be trusted by the Java Runtime Environment used by SSO. By default, no publicly issued CAs are trusted and must be trusted explicitly.
The certificates can be imported using the following syntaxes. The whole certificate chain must be imported using the keytool tool, which can be found in the bin directory of the java installation under JRE_HOME.
Import the server certificate.
./keytool -importcert -alias "SSO Server Certificate" -file ../lib/security/login.example.com.crt -keystore ../lib/security/cacerts
Import the intermediate certificate. Use the intermediate certificate of the issuer of your externally facing TLS/SSL certificate. In this example, the login.example.com certificate was issued by Comodo.
./keytool -importcert -alias "COMODO RSA Domain Validation Secure Server CA" -file ../lib/security/COMODORSADomainValidationSecureServerCA.crt -keystore ../lib/security/cacerts
Import the CA certificate of the issuer of your externally facing TLS/SSL certificate.
./keytool -importcert -alias "COMODO RSA Certification Authority" -file ../lib/security/COMODORSACertificationAuthority.crt -keystore ../lib/security/cacerts
Adding the self signed certificate from the default keystore.pfx
During SSO installation a default keystore is created in $UBILOGIN_HOME/custom/tomcat/keystore.pfx with a self signed certificate, when no existing keystore in the location is found. The self signed certificate can be added to the default cacerts trust store in $JRE_HOME/lib/security/cacerts
keytool -exportcert -keystore $UBILOGIN_HOME/custom/tomcat/keystore.pfx
-alias tomcat -storepass changeit | keytool -importcert -keystore $JRE_HOME/lib/security/cacerts -storepass
changeit -alias ubisecure-sso-servercert -noprompt