Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry UEM 12.20
  3. UEM Configuration Guide
  4. Encrypt the connection between BlackBerry UEM and Microsoft SQL Server

Encrypt the connection between
BlackBerry UEM
 and
Microsoft SQL Server

You can configure an encrypted connection between
BlackBerry UEM
 and
Microsoft SQL Server
. By default, the connection is not encrypted.
  • When you upgrade
    UEM
    , the encryption settings are not retained. After the upgrade, you must repeat steps 3 and on to encrypt the connection again.
  • Please note that the encrypted connection can result in an increase in the UOS CPU on the computer that hosts the
    BlackBerry UEM Core
    .
  • On the computer that hosts the
    SQL Server
    , in the
    Microsoft
     Management Console, use the certificates snap-in to request the computer certificate (select the computer account, Certificates (Local Computer) > right-click Personal > All Tasks > Request New Certificate). You should see the certificate in Certificates (Local Computer) > Personal > Certificates.
    Depending on how
    SQL Server
     is configured, you may need to grant permissions to the certificate to the
    SQL Server
     account.
  • In the
    SQL Server
     Configuration Manager, navigate to the Network Configuration and open the Properties for the
    SQL Server
     Protocols. On the Certificate tab, select the computer certificate. Restart the
    SQL Server
     service.
  • In the
    Microsoft
     Management Console, use the certificates snap-in to export the computer certificate from the personal store (personal.cer). Copy the certificate to each computer that hosts a
    UEM
     instance.
Complete these steps on every computer that hosts a
UEM Core
 instance:
  1. Navigate to and double-click the personal certificate (personal.cer). View the parent certificate (parent.cer) and export and save it to the same folder that contains the personal certificate (for example, C:\blackberry\certs\).
  2. Open the command prompt and run the following commands to import the personal and parent certificates to the
    Java
     keystore and generate a trust store:
    keytool -importcert -keystore "
    <path_to_Java_CA_certs_store>
    " -storepass 
    <CA_certs_store_password>
     -file 
    <path_to_personal_cert>
     -alias personal

keytool -importcert -keystore "
    <path_to_Java_CA_certs_store>
    " -storepass 
    <CA_certs_store_password>
     -file 
    <path_to_parent_cert>
     -alias parent

keytool -import -v -trustcacerts -alias personal -file 
    <path_to_personal_cert>
     -keystore 
    <path_to_folder_with_personal_and_parent_certs>
    \truststore.jks -storepass 
    <password_to_set_for_trust_store>
     -storetype JKS
    For example: 
    keytool -importcert -keystore "c:\Program Files\Eclipse Adoptium\jre-17.0.11.9-hotspot\lib\security\cacerts" -storepass changeit -file c:\blackberry\certs\personal.cer -alias personal

keytool -importcert -keystore "c:\Program Files\Eclipse Adoptium\jre-17.0.11.9-hotspot\lib\security\cacerts" -storepass changeit -file c:\blackberry\certs\parent.cer -alias parent

keytool -import -v -trustcacerts -alias personal -file c:\blackberry\certs\personal.cer -keystore c:\blackberry\certs\truststore.jks -storepass password -storetype JKS
  3. Stop all
    UEM
     services.
  4. In C:\Program Files\BlackBerry\UEM\common-settings, copy and rename
    db.properties
     to create a backup database properties file.
  5. Open
    db.properties
    .
  6. In the
    SQL Server
     encryption settings section, configure the following settings (you do not need to change any other settings):
    configuration.database.ng.encrypt=true
configuration.database.ng.trustservercertificate=false
configuration.database.ng.truststore=
    <path_to_the_jks_trust_store_generated_in_step_2>
    
configuration.database.ng.truststorepassword=
    <password_for_jks_trust_store_generated_in_step_2>
  7. Save and close
    db.properties
    .
  8. Restart the
    UEM
     services.