Installing and configuring BlackBerry UEM in a BSI-certified environment
- Requirements and considerations for a BSI-certified UEM environment
- Prerequisites for installing BlackBerry UEM 12.21 MR1 in a BSI-certified environment
Install BlackBerry UEM version 12.21 MR1 in a BSI-certified environment
Create an LDAP client certificate used for mutual authentication and connect to an LDAP directory
Configure BlackBerry UEM for a BSI-certified environment
- Administrator roles in a BSI-certified UEM environment
Exporting audit records to a syslog server
- Set up the export of device audit records to a syslog server
  - Script to enable the export of server audit records to syslog
- Set up the export of server audit records to a syslog server
  - Script to enable the export of device audit records to syslog

Create an LDAP client certificate used for mutual authentication and connect to an LDAP directory

Verify that the certificates that you will upload to

BlackBerry UEM

(syslog and LDAP) are trustworthy and have the basic constraints and key usage fields set. You must use mutual X.509v3 authentication for the connection between

UEM

and an LDAP server. The certificate that you use must be signed by a Certificate Authority that the LDAP server trusts and must be using one of the following ciphersuites:

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

The .pfx file that you specify in step 1 must contain only the client certificate and the private key.

To upload an LDAP client certificate to use when you are connecting to an LDAP directory, in a batch file, type the following:

SET BESRoot=C:\Program Files\BlackBerry\UEM
SET KEYSTORE_PATH=C:\Users\Administrator\Desktop\LDAP_Info\ldapClientCert\clientauth.pfx
SET KEYSTORE_PASSWORD=password
java -cp "%BESRoot%\tools\lib\*" --add-opens java.base/sun.nio.ch=ALL-UNNAMED --add-exports java.base/jdk.internal.ref=ALL-UNNAMED --add-exports java.base/sun.security.provider.certpath=ALL-UNNAMED -Djava.library.path="%BESRoot%\tools\lib\dll\x64" com.rim.platform.mdm.keymaster.KeyMaster -keystore "%KEYSTORE_PATH%" -password "%KEYSTORE_PASSWORD%" load -keystoreType DIRECTORY -BESRoot "%BESRoot%"

Restart the

UEM Core

service.

UEM

management console.

Navigate to

Settings > External Integration > Company Directory

Add an LDAP directory.

When you configure the LDAP directory, enable SSL and import the trusted CA certificate (not a private key or PFX file).

Click

Save