Encrypt the connection between BlackBerry UEM and Microsoft SQL Server

You can configure an encrypted connection between BlackBerry UEM and Microsoft SQL Server. By default, the connection is not encrypted. The steps below provide instructions for enabling the connected encryption after you install UEM. For instructions for enabling the encrypted connection when you install UEM from the command prompt, see the UEM Installation and Upgrade Guide.
Note: The encrypted connection can result in an increase in the CPU on the computer that hosts the BlackBerry UEM Core.
From Microsoft SQL Server, export the root certificate (.cer) that is used to sign the SQL server certificate. Copy the root certificate onto each computer that hosts a UEM Core instance. The file path where you store the certificate must not contain any spaces.

Complete these steps on every computer that hosts a UEM Core instance:

  1. Open the command prompt and run the following command to import the root certificate into the Java keystore:
    keytool -importcert -keystore "<path_to_Java_CA_certs_store>" -storepass <CA_certs_store_password> -file <path_to_SQL_root_certificate> -alias root
    For example: 
    keytool -importcert -keystore "c:\Program Files\Eclipse Adoptium\jre-17.0.11.9-hotspot\lib\security\cacerts" -storepass changeit -file c:\sqlcert\root.cer -alias root
  2. Stop all UEM services.
  3. In C:\Program Files\BlackBerry\UEM\common-settings, copy and rename db.properties to create a backup database properties file.
  4. Open db.properties.
  5. In the SQL Server encryption settings section, configure the following settings (you do not need to change any other settings):
    configuration.database.ng.encrypt=true
configuration.database.ng.trustservercertificate=false
configuration.database.ng.trustmanagerclass=mdm.contract.database.ssl.
            NiapSQLServerTrustManager
configuration.database.ng.trustmanagerconstructorarg=<path_to_SQL_root_certificate>
  6. Save and close db.properties.
  7. Restart the UEM services.