{"type":"doc","content":[{"type":"paragraph","content":[{"text":"This article describes how to upgrade ","type":"text"},{"text":"Protocol Gateway","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65347462"}}]},{"text":".","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Protocol Gateway has support for changing the directory where Protocol Gateway puts the cm-gateway directory containing configuration and logs using the cm-gateway.base parameter.","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"paragraph","content":[{"text":"The following prerequisites apply: ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Protocol Gateway is installed. See ","type":"text"},{"text":"Install Protocol Gateway","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65350570"}}]},{"text":".","type":"text"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"1. Stop the Tomcat service","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"2. Back up Protocol Gateway folder","type":"text"}]},{"type":"paragraph","content":[{"text":"Back up the Protocol Gateway folder: ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Navigate to the Tomcat ","type":"text"},{"text":"/webapps","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" folder.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make a backup of the existing ","type":"text"},{"text":"/pgwy","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" folder for reference and delete the original.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"3. Upgrade from a specific version","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Sequential upgrade process","type":"text"}]},{"type":"paragraph","content":[{"text":"To upgrade from older versions to newer versions, you must upgrade each version step-by-step. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: ","type":"text","marks":[{"type":"strong"}]},{"text":"Starting from 8.5.0, you must upgrade to 8.6.x and thereafter to 8.7.1. ","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The following configurations are done in configuration files in ","type":"text"},{"text":"","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":". ","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"excerpt-include","parameters":{"macroParams":{"":{"value":"Configuration files in Protocol Gateway"},"name":{"value":"configroot path"},"nopanel":{"value":"true"}},"macroMetadata":{"macroId":{"value":"2cedc3ca-9405-4225-8b22-bc23add8f55f"},"schemaVersion":{"value":"1"},"title":"Insert excerpt"}},"localId":"6f1bb2ba-a69d-4d15-b118-e1f5a121f561"}}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 7.18 to 8.0","type":"text"}]},{"type":"expand","attrs":{"title":"Configure REST API"},"content":[{"type":"paragraph","content":[{"text":"The numbering of the handlers has been changed in the file ","type":"text"},{"text":"/api.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":":","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the file is unmodified, remove this file and it will be recreated with new defaults when restarting Protocol Gateway.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the file has been modified, then do the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the file ","type":"text"},{"text":"/api.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" for editing. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Change the numbers on all configured handlers and their related configuration so that the number corresponds to the following numbering scheme:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: api.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"handler.0.filter = certificates\nhandler.10.filter = certificates/revoke\nhandler.11.filter = certificates/reinstate\nhandler.20.filter = certificates/[a-z0-9A-Z]+/details\nhandler.21.filter = certificates/[a-z0-9A-Z]+/download\nhandler.30.filter = certificates/pkcs10\nhandler.50.filter = procedures\n","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following lines at an appropriate place in the file:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: api.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# Process PKCS10 request -> PKCS12 response\nhandler.31.filter = certificates/pkcs10-to-pkcs12\nhandler.31.format = api/certificates-pkcs10-to-pkcs12\nhandler.31.tokenprocedure = Token Procedure Name - must be configured","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the file.","type":"text"}]}]}]}]}]}]},{"type":"expand","attrs":{"title":"Configure V2X API"},"content":[{"type":"paragraph","content":[{"text":"The settings in ","type":"text"},{"text":"c2x.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" have changed:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If this file exists in your environment, remove it. A new version with default values will appear when restarting Protocol Gateway.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 8.0 to 8.1","type":"text"}]},{"type":"expand","attrs":{"title":"Configure Protocol Gateway properties"},"content":[{"type":"paragraph","content":[{"text":"Protocol Gateway has gained the ability to send metrics to InfluxDB.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use this feature, do the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the file ","type":"text"},{"text":"/cm-gateway.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" for editing. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following lines after the setting for ","type":"text"},{"text":"cmhost","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: cm-gateway.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# CM-Connections is the maximum amount of concurrent officer connections to CF\n# to allocate to the officer pool.\ncmconnections = 20","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following lines at the end of the file:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: cm-gateway.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"#= Metrics reporter\n#\n# metrics.influxdb.url - If non-empty, PGW will report metrics to an\n# InfluxDB database at this URL.\n#\n#metrics.influxdb.url = http://localhost:8086\n# metrics.influxdb.user - The user name to be used when reporting metrics\n# to InfluxDB.\n#\n#metrics.influxdb.user =\n# metrics.influxdb.password - The password to be used when reporting\n# metrics to InfluxDB.\n#\n#metrics.influxdb.password =\n# metrics.influxdb.dbname - The InfluxDB database name where metrics will\n# be stored. The database must already exist in InfluxDB. Defaults to\n# \"cm_metrics\" if not specified.\n#\n#metrics.influxdb.dbname = cm_metrics\n# metrics.influxdb.interval - How often metrics should be sent to\n# InfluxDB (in seconds). Defaults to 30s if not specified.\n#\n#metrics.influxdb.interval = 30","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the file. ","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Configure REST API"},"content":[{"type":"paragraph","content":[{"text":"The REST API configuration has been extended with additional endpoints.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use these features, do the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the file ","type":"text"},{"text":"/api.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" for editing. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following lines at the end of the file:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: api.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# Registration Endpoints\n# HTTP GET: search\n# HTTP POST: create\n# HTTP PUT: edit\n# registrations/{procid}\nhandler.60.filter = registrations/[a-z0-9A-Z\\- ]+\nhandler.60.format = api/registrations-list\nhandler.60.getformat = api/registrations-list\nhandler.60.postformat = api/registrations-create\nhandler.60.putformat = api/registrations-update\n# registrations/{procid}/{protocol}\nhandler.61.filter = registrations/[a-z0-9A-Z\\- ]+/(?i)(est|acme|cmp|scep)\nhandler.61.format = api/registrations-list-protocol\nhandler.61.getformat = api/registrations-list-protocol\nhandler.61.postformat = api/registrations-create-protocol\nhandler.61.putformat = api/registrations-update-protocol\n# registrations/certificate/{certid}\nhandler.62.filter = registrations/certificate/[0-9]+\nhandler.62.format = api/registrations-get-certid\n################\n# ACME Endpoints\n# registrations/{procid}/acme/accounts\nhandler.70.filter = registrations/[a-z0-9A-Z\\- ]+/acme/accounts\nhandler.70.format = api/registrations-list-acme-accounts","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the file.","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Configure EST"},"content":[{"type":"paragraph","content":[{"text":"The EST configuration has been extended with additional options.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use these features, do the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the file ","type":"text"},{"text":"/est.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" for editing. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace the description of the parameters to the following:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: est.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"#- Parameters\n#\n# filter - contains a filter for the handler part of the URL\n# specified as a regular expression. NOTE: If using the CoAP proxy,\n# regular expressions in the filters are not supported.\n#\n# format - contains the name of a format definition file. For regular\n# EST the format definition files with the prefix 'est-' should be used. For\n# EST over CoAPs the files with the prefix 'estcoaps-' should be used instead.\n#\n# tokenprocedure - contains the description or id of a token procedure\n# in the CM server.\n#\n# ra.keyfile - is the token to sign the fullcmc responses.\n# Not required if fullcmc is disabled.\n#\n# ra.password - is the password to the keyfile. It is recommended to\n# obfuscate sensitive data with .encrypted.\n#\n# requiredRoRoles - optional, contains a space or comma separated list\n# of required Registration Officer roles. This requires client\n# authentication to be enabled in Tomcat, and verifies that the\n# client certificate is an officer. If the role \"none\" is entered,\n# the client certificate must be issued by CM but does not need to\n# be an officer. \"/cacerts\" must not be protected behind client\n# authentication, and therefore no default role should be set.\n#\n# authtype - optional, enables HTTP Basic/Digest authentication by\n# specificing the desired authentication type. May only be set\n# for filters simpleenroll and simplereenroll.\n# Example:\n# handler..authtype = Basic\n# handler..authtype = Digest\n#\n# realm - required if authtype is set, may be empty. Determines which\n# realm the login should occur on. Can only be set for filters\n# simpleenroll and simplereenroll.\n#\n# qop - optional, determines the quality of protection used with\n# Digest authentication. Valid value is 'auth'. If not specified\n# then no Quality of Protection will be required.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the file.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 8.1 to 8.2","type":"text"}]},{"type":"expand","attrs":{"title":"Configure REST API"},"content":[{"type":"paragraph","content":[{"text":"The REST API configuration has been extended with additional endpoints.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use these features, do the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the file ","type":"text"},{"text":"/api.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" for editing. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following lines below the certificate endpoints:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: api.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# Process PKCS10 request -> PKCS7 (secure key injection package) response\nhandler.32.filter = certificates/skip\nhandler.32.format = api/certificates-skip\nhandler.32.tokenprocedure = Token Procedure Name - must be configured\n\n# Process X509 certificate import\nhandler.33.filter = certificates/import-pki-x509\nhandler.33.format = api/certificates-import-pki-x509\nhandler.33.importlimit = 100\nhandler.33.tokenprocedure = Token Procedure Name - must be configured","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the file.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 8.2 to 8.3","type":"text"}]},{"type":"expand","attrs":{"title":"Configure SCEP"},"content":[{"type":"paragraph","content":[{"text":"The SCEP implementation has been updated in the following ways:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Support for a ","type":"text"},{"text":"CA Certificate Only Response","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" has been added, according to ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://tools.ietf.org/html/draft-nourse-scep-23#section-5.2.1.1.1"}},{"text":" .","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Support for dynamic challenge passwords has been added, complying to Microsoft's Network Device Enrollment Service (NDES) implementation. ","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"To use these features, do the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the file ","type":"text"},{"text":"/scep.properties ","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":"is unmodified, remove this file and it will be recreated with new defaults when restarting Protocol Gateway.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the file has been modified, then do the following: ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the file ","type":"text"},{"text":"/scep.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" for editing. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following lines below ","type":"text"},{"text":"default.racachainlength = 0","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: scep.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# Changes the response format for the GetCACert call to return the RA\n# certificate in binary format if set to true.\n# Only works if racachainlength is set to 1.\ndefault.responseasbinary = false","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following lines below ","type":"text"},{"text":"default.ra.signature.keyusage = digitalsignature","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: scep.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# SCEP INTUNE\n#\n# SCEP Intune allows for integration with Azure AD to automatically\n# enroll and manage iOS, Android, Windows and Mac devices.\n#\n# tenant - is the Tenant which is the fully qualified domain name (FQDN)\n# of the organization configured in Intune.\n#\n# azure_app_id - specifies the azure application id of the app\n# registration.\n#\n# azure_app_key - specifies the client secret of the app registration.\n#\n# certificateAuthority - specifies the name of the CA performing the\n# requests to Intune.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Append the following lines at the end of the file:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: scep.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# http://:/pgwy/scep/ndeschallenge/\n#\n# Handler for SCEP dynamic challenge endpoint (NDES compliant)\n#\nhandler.3.filter = ndeschallenge/\nhandler.3.format = scep-ndes\nhandler.3.ndesUsername = ndesadmin\nhandler.3.ndesPassword = ndespassword\nhandler.3.ndesChallengeValidity = PT15M\n# http://:/pgwy/scep/ndesrequest\n#\n# Handler for SCEP request using dynamic challenge password\n(NDES compliant)\n#\nhandler.4.filter = ndesrequest\nhandler.4.format = scep\nhandler.4.tokenprocedure = SCEP Registration and Enroll Procedure\nwith NDES Challenge\n\n# http://:/pgwy/scep/intune/pkiclient.exe\n#\n# Handler for requests that should be validated against a Microsoft\n# Intune server.\nhandler.5.filter = intune/pkiclient.exe\nhandler.5.format = scep-intune\nhandler.5.tenant = tenant\nhandler.5.azure_app_id = app-id\nhandler.5.azure_app_key = app-key\nhandler.5.certificateAuthority = CA","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the file.","type":"text"}]}]}]}]}]}]},{"type":"expand","attrs":{"title":"Configure CMC"},"content":[{"type":"paragraph","content":[{"text":"Support for CMC revoke request has been added.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use this feature, do the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the file ","type":"text"},{"text":"/cmc.properties ","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":"is unmodified, remove this file and it will be recreated with new defaults when restarting Protocol Gateway.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the file has been modified, then do the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the file ","type":"text"},{"text":"/cmc.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" for editing.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following lines below ","type":"text"},{"text":"default.tokenprocedure = TLS Web Server Token","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: cmc.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# ra.keyfile - is the token to sign the fullcmc responses,\nrequired for CMC Revoke.\n# Not required if CMC Revoke handler is disabled.\n# ra.password - is the password to the keyfile. It is recommended to\n# obfuscate sensitive data with .encrypted.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Append the following lines at the end of the file:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: cmc.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"handler.2.filter = revoke\nhandler.2.filterContentType = application/pkcs7-mime;\\h*smime-type\\h*=\n\\h*CMC-request\nhandler.2.format = cmc-revoke\n# fullcmc responses (required as response to Revocation request) require\nan RA token to be signed with\nhandler.2.ra.keyfile = protocol-gateway-ra.p12\nhandler.2.ra.password = abcd1234","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the file.","type":"text"}]}]}]}]}]}]},{"type":"expand","attrs":{"title":"Configure V2X API"},"content":[{"type":"paragraph","content":[{"text":"Support for configuring connection properties to the authorization server has been added.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use this feature, do the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the file ","type":"text"},{"text":"/c2x.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" is unmodified, remove this file and it will be recreated with new defaults when restarting Protocol Gateway.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If it has been modified, then do the following:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the file ","type":"text"},{"text":"/c2x.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" for editing.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace the line ","type":"text"},{"text":"#default.authorizationUrl = ","type":"text","marks":[{"type":"code"}]},{"text":" with the following lines:","type":"text"}]},{"type":"paragraph","content":[{"text":"c2x.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# Parameters for the AccessTokenVerifier modifier.\n#\n# default.authorizationUrl = \n# default.authKeyCacheLifeSpan = P365D\n# default.authKeyCacheRefreshTime = P1D\n#\n# Timeout values in ms.\n# default.authKeyConnectTimeout = 1000\n# default.authKeyReadTimeout = 1000","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the file.","type":"text"}]}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 8.3 to 8.4.x","type":"text"}]},{"type":"expand","attrs":{"title":"Configure EST"},"content":[{"type":"paragraph","content":[{"text":"The EST configuration has been extended with additional options.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use these features, do the following updates in ","type":"text"},{"text":"/est.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":":","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the new parameter and description to the simplereenroll handler, default handler 2:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: est.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# Controls if the client TLS certificate must match the latest issued certificate\n# for the requested subject. Set to false as default.\n# handler.2.allowRenewalWithOldCertificates = false","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 8.4.x to 8.5.x","type":"text"}]},{"type":"expand","attrs":{"title":"Configure ACME"},"content":[{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"This is only relevant if you are upgrading from 8.4.0. This is not needed if you update from 8.4.1 or later. ","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The ACME configuration has been extended with additional options.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use these features, do the following updates in ","type":"text"},{"text":"/acme.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":":","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the new parameter description to the end of the Parameters section:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: acme.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# addAccountContactEmail - If true, adds the contact email address from the\n# requesting account to the Rfc822 name field to the SAN extension in the\n# certificate request.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Append the following to the list of default values in the Parameters section:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: acme.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"#default.addAccountContactEmail = false","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Configure WinEP"},"content":[{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"This is only relevant if you are upgrading from 8.4.0. This is not needed if you update from 8.4.1 or later. ","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The WinEP configuration has been extended with additional options.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use these features, do the following updates in ","type":"text"},{"text":"/winep.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":":","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following new parameter descriptions to the Define handlers section: ","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: winep.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# enrollmentAgent.certs.x - a list of file paths of the X.509 Enrollment Agent certificates.\n\n# enrollmentAgent.allowedGroups - optional, a comma separated list of AD groups\n# that this enrollment agent is able to issue certificates for. If the EOBO\n# target user is in any of the defined groups then the request will pass.\n# If not set then all groups are allowed.\n# Group names are case insensitive.\n\n# enrollmentAgent.blockedGroups - optional, a comma separated list of AD groups\n# that this enrollment agent is blocked from issuing certificates for. If the\n# EOBO target user is in any of the defined groups then the request will be denied.\n# If not set then no groups are blocked.\n# Group names are case insensitive.\n# Blocked groups have a higher precedence than allowed groups. That is, if a user\n# belongs to both an allowed and a blocked group, issuing of certificates will be\n# blocked for that user.","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Configure REST API"},"content":[{"type":"paragraph","content":[{"text":"Upgrade from 8.4.0","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Do the following updates in ","type":"text"},{"text":"/api.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":":","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Update the V2x Endpoints to reflect the following:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: api.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# V2x Endpoints\n# /registrations/v2x/{vin}\nhandler.80.filter = registrations/v2x/[a-z0-9A-Z\\- ]+\nhandler.80.deleteformat = api/v2x-vin-delete\nhandler.80.requiredroroles = dataretention.manage","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Upgrade from 8.4.x (later than 8.4.0)","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Do the following updates in ","type":"text"},{"text":"/api.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":":","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the certificates Endpoint to reflect the following: ","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: api.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# List of issuer certificates\n handler.1.filter = certificates/issuers\n handler.1.format = api/issuers-list","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Configure ITSS"},"content":[{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"This is only relevant if you are upgrading from 8.4.0. This is not needed if you update from 8.4.1 or later. ","type":"text"}]}]},{"type":"paragraph","content":[{"text":"If the file ","type":"text"},{"text":"itss.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" is unmodified, then remove the file and it will reappear when restarting PGW.","type":"text"}]},{"type":"paragraph","content":[{"text":"If it has been modified, then do the following updates in ","type":"text"},{"text":"/itss.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":":","type":"text"}]},{"type":"paragraph","content":[{"text":"Remove the following endpoint handler configuration:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: itss.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"handler.2.filter = auth-pop\nhandler.2.tokenprocedure = Token Procedure Name - must be configured","type":"text"}]}]},{"type":"expand","attrs":{"title":"Configure CM-Gateway"},"content":[{"type":"paragraph","content":[{"text":"It is now possible in Protocol Gateway to specify CM Host in the protocol handler level. Also added is SNI support, which allows obtaining the correct server certificate by the CM SDK client during TLS handshake.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use these features, do the following updates in ","type":"text"},{"text":"/cm-gateway.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":":","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace the description of CM HOST with the following: ","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: cm-gateway.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":" # CM Host\n #\n # Note: a CM Host can, if necessary, also be specified in the properties\n # file for a protocol service, with the same parameter as below.\n #\n # CM-Host must be set to the network id of the machine that hosts the CF that\n # should be used by the Protocol Gateway services. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following lines after TLS parameters section:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example 2: cm-gateway.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":" # ssl.servernameindication - Holds the SNI (server name indication) host name\n # of CM to be sent in the TLS client hello packet to indicate the name of the\n # CM server to communicate with. This is useful for cases where CM is behind a\n # proxy or load balancer, and the proxy having a different host\n # name hosting a different server certificate by default.\n # Leave commented to disable SNI.\n #ssl.servernameindication = localhost","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Configure SCEP"},"content":[{"type":"paragraph","content":[{"text":"The SCEP configuration has been extended with additional options.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use these features, do the following updates in ","type":"text"},{"text":"/scep.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":":","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following new parameter description at the end of the SCEP INTUNE section: ","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: scep.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":" #\n # issuerName - optional, specifies the ca configuration name of the issuing CA,\n # used to filter requests when polling for revoked certificates.\n #\n # issuerFilter - optional, specifies the distinguished name of the issuing CA,\n # \t\t\t\tused to filter revocations to process after polling and fetching \t\n\t\t\t\tthe revoked certificates.\n #\n # revocationTaskPeriod - optional, the duration between polling attempts towards\n # Intune to fetch revocation data, specified in\n # ISO 8601 format.\n # Default: PT10M\n #\n # revocationRequestSize - optional, the batch size of fetched revocation\n # data, must be set between 1 and 500.\n # Default: 100\n #\n # revocationReason - optional, the revocation reason to apply to revocation\n # requests received from Intune.\n # Possible values are:\n # Key compromised: 1\n # Affiliation Changed: 3\n # Superseded: 4\n # Cessation of Operation: 5\n # Privilege Withdrawn: 9\n # Default: 4\n # intuneProxyHost - optional, if the server hosting PGW does not have the\n # internet access required to successfully verify incoming\n # requests against intune, you can instead configure a proxy\n # to direct the intune requests through.\n #\n # intuneProxyPort - optional, intune proxy port. Must be set if\n # 'intuneProxyHost' is set.\n #\n # intuneProxyUser - optional, intune proxy user\n #\n # intuneProxyPass - optional, intune proxy password. Must be set if\n # 'intuneProxyUser' is set.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 8.5.x to 8.6.x","type":"text"}]},{"type":"expand","attrs":{"title":"Configure REST API"},"content":[{"type":"paragraph","content":[{"text":"The REST API has been extended.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use the latest endpoint, do the following updates in ","type":"text"},{"text":"/api.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":":","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following lines under ","type":"text"},{"text":"Certificate endpoints","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":": ","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: api.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# Process PKCS10 request -> Attribute Certificate\n handler.34.filter = certificates/[a-z0-9A-Z]+/pkcs10-to-attr-cert\n handler.34.format = api/certificates-pkcs10-to-attr-certificate\n handler.34.tokenprocedure = Token Procedure Name - must be configured","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 8.6.x to 8.7.1","type":"text"}]},{"type":"expand","attrs":{"title":"Configure SCEP"},"content":[{"type":"paragraph","content":[{"text":"The SCEP configuration has been extended with additional options.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use these features, do the following updates in ","type":"text"},{"text":"/scep.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":":","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace the following parameter description in the SCEP INTUNE section: ","type":"text"}]},{"type":"paragraph","content":[{"text":"Replace this in scep.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# issuerName - optional, specifies the distinguished name of the issuing CA,\n# used to filter requests when polling for revoked certificates.","type":"text"}]},{"type":"paragraph","content":[{"text":"with this:","type":"text"}]},{"type":"paragraph","content":[{"text":"Replace the previous with this:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# issuerName - optional, specifies the ca configuration name of the issuing CA,\n# used to filter requests when polling for revoked certificates.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following new parameter description after the ","type":"text"},{"text":"issuerName","type":"text","marks":[{"type":"code"}]},{"text":" parameter description in the","type":"text"},{"type":"hardBreak"},{"text":"SCEP INTUNE section:","type":"text"}]},{"type":"paragraph","content":[{"text":"Add this in scep.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# issuerFilter - optional, specifies the distinguished name of the issuing CA,\n# used to filter revocations to process after polling and fetching the revoked \n# certificates.","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Configure C2X"},"content":[{"type":"paragraph","content":[{"text":"The C2X configuration has been extended with additional options.","type":"text"}]},{"type":"paragraph","content":[{"text":"The cache related settings in ","type":"text"},{"text":"c2x.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" have changed.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the file is unmodified, remove this file and it will be recreated with new defaults when restarting PGW.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If it has been modified, then do the following changes:","type":"text"}]}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace this: ","type":"text"}]},{"type":"paragraph","content":[{"text":"Replace this:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"default.ectlCilProcedure = \ndefault.ectlCache = PT10M","type":"text"}]},{"type":"paragraph","content":[{"text":"with this:","type":"text"}]},{"type":"paragraph","content":[{"text":"Replace the previous with this:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# The Composite CTL and ECTL procedures are used in initialization\n# and must be specified as default values.\ndefault.cctlCilProcedure = \ndefault.ectlCilProcedure = \n# default.ectlFile =\ndefault.cache = PT10M","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace this:","type":"text"}]},{"type":"paragraph","content":[{"text":"Replace this:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"handler.1.filter = truststore/v1/?\nhandler.1.format = c2x_initialization\nhandler.1.stsfCilProcedure = \nhandler.1.stfsCache = ","type":"text"}]},{"type":"paragraph","content":[{"text":"with this:","type":"text"}]},{"type":"paragraph","content":[{"text":"Replace the previous with this:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"handler.1.filter = truststore/v1/?\nhandler.1.format = c2x_initialization\nhandler.1.cilProcedure = ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Remember to also update the configuration values after these steps are performed.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 8.7.0 to 8.7.1","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Certificate Manager v8.7.0","type":"text"}]},{"type":"paragraph","content":[{"text":"Certificate Manager version 8.7.0 is no longer available on Nexus support portal. ","type":"text"}]}]},{"type":"expand","attrs":{"title":"Configure WinEP"},"content":[{"type":"paragraph","content":[{"text":"The following two new parameters must be added to winep.properties after default.requiredRoRoles = cert.issue :","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Example: winep.properties","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"# - allowNullPkcs10Signature, controls whether Null Signature (MS-WCCE v20211006)\n# is allowed on the PKCS10 in the received requests. Default: true\n# default.allowNullPkcs10Signature = true\n\n# - allowNoSignature, controls whether No-Signature Signature is allowed on the\n# received requests. Default: true\n# default.allowNoSignature = true","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 8.7.x to 8.8.x","type":"text"}]},{"type":"expand","attrs":{"title":"CM-Gateway configuration"},"content":[{"type":"paragraph","content":[{"text":"The CM-Gateway configuration has been extended with additional options. To ease use of the latest features, the following steps should be taken on the file /cmgateway. properties:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following new parameters after the cmconnections parameter in the CM Host section:","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"# cmclientretries - How many times sending a request should be retried\n# if the connection to CM is unexpectedly closed. Default value is 0.\n#cmclientretries = 0\n# cmnopinterval - The number of seconds between each no-operation request to\n# the server. This counter is unique for each connection and will only trigger\n# if the connection has been idle for longer than the given interval.\n# cmnopinterval = 60","type":"text"}]}]},{"type":"expand","attrs":{"title":"C2X configuration"},"content":[{"type":"paragraph","content":[{"text":"A new configuration parameter for Access Token Scope Whitelisting and new V2X V2 endpoints have been added to c2x.properties. If the file is unmodified, remove this file and it will be recreated with new defaults when restarting PGW. If it has been modified, then perform the following changes:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following new parameters after the default.authKeyReadTimeout parameter in the default parameters section:","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"# Access Token Scope Whitelist.\n# If this parameter is not used all scopes will be accepted.\n# Each scope should be separated by a comma sign, like the example below:\n# default.whitelistedScopes = scope_1, scope_2\n# default.whitelistedScopes =","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following new parameters to the end of the file:","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"handler.10.filter = truststore/v2/?\nhandler.10.format = c2x_initialization_v2\nhandler.10.cilProcedure = V2X VW initialization message\nhandler.10.tokenprocedure = V2X ECA Enroll enabling registration\nhandler.11.filter = enrollment/v2/?\nhandler.11.format = c2x_enrollment_v2\nhandler.11.tokenprocedure = V2X Enrollment Token V2\nhandler.12.filter = pseudonym-certificate-batch/v2/?\nhandler.12.format = c2x_registration_v2\nhandler.12.tokenprocedure = V2X Registration Request Token V2\n# \"Registration\" endpoint can be configured to save all registration requests\n# to a local directory, for debugging purposes. This directory is relative to\n# . If left empty, the registrations will not be debug dumped.\n#handler.12.relativePathToRequestsFolder = c2xRegistrationsv2\nhandler.13.filter = pseudonym-certificate-batch/v2/(.+)\nhandler.13.format = c2x_download_v2\n# \"Download\" endpoint requires that the cert zips are pre-produced, and\n# available in a local directory or in S3 object storage.\n# This directory is relative to .\nhandler.13.relativePathToFilesFolder = c2xCerts\nhandler.14.filter = crl/v2/?\nhandler.14.format = c2x_crl_download_v2\nhandler.14.crlProcedure = V2X VW composite CRL\nhandler.15.filter = ctl/v2/?\nhandler.15.format = c2x_ctl_download_v2","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Remove the parameter below from all handlers:","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"crlCache","type":"text"}]}]},{"type":"expand","attrs":{"title":"Configure WinEP"},"content":[{"type":"paragraph","content":[{"text":"The following two new parameters need to be added to winep.properties after default.requiredRoRoles = cert.issue :","type":"text"}]},{"type":"codeBlock","content":[{"text":"# - allowNullPkcs10Signature, controls whether Null Signature (MS-WCCE v20211006)\n# is allowed on the PKCS10 in the received requests. Default: true\n# default.allowNullPkcs10Signature = true\n\n# - allowNoSignature, controls whether No-Signature Signature is allowed on the\n# received requests. Default: true\n# default.allowNoSignature = true","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 8.8.x to 8.9.x","type":"text"}]},{"type":"expand","attrs":{"title":"Tomcat 10.1"},"content":[{"type":"paragraph","content":[{"text":"With the release of version 8.9.0 of Protocol Gateway the version of Apache Tomcat must be upgraded to Tomcat 10.1. To upgrade from a previous version of Tomcat, first close any running instances of Tomcat and then install Tomcat 10.1.","type":"text"}]},{"type":"paragraph","content":[{"text":"For more information, see ","type":"text"},{"text":"Install Protocol Gateway","type":"text","marks":[{"type":"link","attrs":{"href":"https://nexusdoc.atlassian.net/wiki/spaces/PUB/pages/65350570"}}]},{"text":". ","type":"text"}]}]},{"type":"expand","attrs":{"title":"Java 17"},"content":[{"type":"paragraph","content":[{"text":"Make sure 64-bit Java SE 17 is installed and used by Tomcat.","type":"text"}]}]},{"type":"expand","attrs":{"title":"API configuration"},"content":[{"type":"paragraph","content":[{"text":"The REST API has been extended. To use the latest endpoint, the following steps should be taken on the file /api.properties:","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following lines under the Certificate endpoints to enable the procedure details endpoint:","type":"text"}]},{"type":"codeBlock","content":[{"text":"handler.51.filter = procedures/[a-z0-9A-Z\\- ]+/details\nhandler.51.format = api/procedures-details","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following lines under the Certificate endpoints to enable downloading multiple certificates in a zip file:","type":"text"}]},{"type":"codeBlock","content":[{"text":"handler.22.filter = certificates/download\nhandler.22.format = api/certificates-downloads","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following lines under the Certificate endpoints to enable the statistics endpoints:","type":"text"}]},{"type":"codeBlock","content":[{"text":"################\n# Statistics Endpoints\n# /statistics/{StatisticsType}\nhandler.90.filter = statistics/[a-z0-9A-Z\\- ]+\nhandler.90.format = api/statistics","type":"text"}]}]},{"type":"expand","attrs":{"title":"logging.properties configuration"},"content":[{"type":"paragraph","content":[{"text":"To prevent unnecessary logging in PGW when running the CM Web UI and Auth servlet the following steps should be taken on the file /logging.properties:","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following line under org.apache.tomcat.util.net.level:","type":"text"}]},{"type":"codeBlock","content":[{"text":"com.id2tech.net.jsse.level = INFO","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following lines under com.nexussafe.cm.pgwy.scep.subject = cn to set the logging level for hazelcast:","type":"text"}]},{"type":"codeBlock","content":[{"text":"# hazelcast logger\ncom.hazelcast.level = WARNING\ncom.hazelcast.cp.level = SEVERE","type":"text"}]}]},{"type":"expand","attrs":{"title":"SCEP configuration"},"content":[{"type":"paragraph","content":[{"text":"The SCEP configuration has been extended with an additional option. To ease use of the latest features the following steps should be taken on the file /scep.properties:","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following new parameter after the handler.3.ndesChallengeValidity parameter:","type":"text"}]},{"type":"codeBlock","content":[{"text":"handler.3.ndesChallengeEncoding = UTF-8","type":"text"}]}]},{"type":"expand","attrs":{"title":"CMP configuration"},"content":[{"type":"paragraph","content":[{"text":"The CMP configuration has been extended with additional options. To ease use of the latest features, the following steps should be taken on the file /cmp.properties:","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following parameter descriptions before the # Define handlers section:","type":"text"}]},{"type":"codeBlock","content":[{"text":"# CMP MODE\n#\n# CMP is allowed to be in client or RA mode. Client mode requires that all\n# incoming requests contain a valid Proof-Of-Possession signature. RA mode\n# allows for the raVerified Proof-Of-Possession, where a RA has signed the\n# request on behalf of an end-entity.\n#\n# mode - specifies the mode to run in. Default mode is client. Possible values\n# are client, ra, and ra-strict. ra mode allows both client and ra\n# requests. ra-strict enforces raVerified Proof-Of-Possession.\n#\n# CMP RA Mode\n#\n# When a handler is in RA mode it requires some additional parameters. See\n# handler.4.* for example configuration. Using officer validation is the\n# recommended way to validate the RA. Either certificate pinning or officer\n# validation is required. Both is also possible but not necessary.\n#\n\n# ramode.certs.x - a list of file paths of the X.509 RA certificates to validate\n# the PKIMessage against. Paths are relative to the location of this file.\n#\n# ramode.officervalidation - specifies a requirement that the RA signer\n# should be forwarded to CF for officer validation. Default: true\n#","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following example handler after #handler.3.:","type":"text"}]},{"type":"codeBlock","content":[{"text":"# RA mode\n#\n# handler.4.filter = ra\n# handler.4.mode = ra-strict\n# handler.4.ramode.certs.1 = cmp-ra-signer-one.cer\n# handler.4.ramode.certs.2 = cmp-ra-signer-two.cer\n# handler.4.ramode.officervalidation = true","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 8.9.x to 8.10.x","type":"text"}]},{"type":"expand","attrs":{"title":"SCEP configuration"},"content":[{"type":"paragraph","content":[{"text":"The SCEP configuration has been extended with an additional option. To ease use of the latest features the following steps should be taken on the file /scep.properties:","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following new parameter description to the end of the SCEP INTUNE section:","type":"text"}]},{"type":"codeBlock","content":[{"text":"# intuneResourceUrl - optional, intune resource url. Must have trailing slash.\n# Do not modify unless required.\n# Default: https://api.manage.microsoft.com/\n#\n# intuneGraphUrl - optional, intune graph resource url. Must have trailing slash.\n# Do not modify unless required.\n# Default: https://graph.windows.net/\n#\n# intuneMsGraphUrl - optional, intune ms graph resource url. Must have trailing\n# slash. Do not modify unless required.\n# Default: https://graph.microsoft.com/\n#\n# intuneAuthUrl - optional, intune auth authority url. Must have trailing slash.\n# Do not modify unless required.\n# Default: https://login.microsoftonline.com/","type":"text"}]}]},{"type":"expand","attrs":{"title":"logging.properties configuration"},"content":[{"type":"paragraph","content":[{"text":"To ease log level configuration for REST API servlet and Auth servlet in PGW the following steps should be taken on the file /logging.properties:","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following lines under section # per protocol level:","type":"text"}]},{"type":"codeBlock","content":[{"text":"com.nexussafe.cm.pgwy.auth.level = FINE\ncom.nexussafe.cm.pgwy.api.level = FINE","type":"text"}]}]},{"type":"expand","attrs":{"title":"API configuration"},"content":[{"type":"paragraph","content":[{"text":"The REST API has been extended. To be able to use the latest endpoints, the following steps should be taken on the file /api.properties:","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following lines under the /registrations/v2x/{vin} to enable the new v2x endpoints:","type":"text"}]},{"type":"codeBlock","content":[{"text":"handler.81.filter = registrations/v2x/delete\nhandler.81.postformat = api/v2x-vin-delete-post\nhandler.81.requiredroroles = dataretention.manage\nhandler.82.filter = registrations/v2x/reset\nhandler.82.postformat = api/v2x-vin-reset\nhandler.82.requiredroroles = dataretention.manage","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following lines under handler 34 to enable the new signature endpoint:","type":"text"}]},{"type":"codeBlock","content":[{"text":"handler.40.filter = signatures/[a-z0-9A-Z\\- ]+\nhandler.40.format = api/generate-signature","type":"text"}]},{"type":"panel","attrs":{"panelType":"note"},"content":[{"type":"paragraph","content":[{"text":"The new signature endpoint requires the following officer role: ","type":"text"},{"text":"Signing Authority Requests","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"paragraph","content":[{"text":"Add the following lines under handler 90 to enable the new officers endpoint:","type":"text"}]},{"type":"codeBlock","content":[{"text":"handler.100.filter = officers\nhandler.100.format = api/officers-details","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"From 8.10.x to 8.11.0","type":"text"}]},{"type":"expand","attrs":{"title":"CM-Gateway configuration"},"content":[{"type":"paragraph","content":[{"text":"The CM-Gateway configuration has been extended with additional options. To ease use of the latest features, the following steps should be taken on the file /cmgateway. properties:","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following new parameters after the ","type":"text"},{"text":"cmhost ","type":"text","marks":[{"type":"strong"}]},{"text":"parameter in the ","type":"text"},{"text":"CM Host","type":"text","marks":[{"type":"strong"}]},{"text":" section:","type":"text"}]},{"type":"codeBlock","content":[{"text":"# cmconnectiontimeout - number of milliseconds the connector will wait trying to\n# connect to the CF server. Default value is 0, meaning infinite.\n#\n# Note: a CM connection timeout can, if necessary, also be specified in the\n# properties file for a protocol service, with the same parameter as below.\n#cmconnectiontimeout = 0\n\n# cmreadtimeout = number of milliseconds the connector will wait trying to\n# receive data from the CF server. Default value is 3600000, meaning one hour.\n#\n# Note: a CM read timeout can, if necessary, also be specified in the properties\n# file for a protocol service, with the same parameter as below.\n#cmreadtimeout = 3600000","type":"text"}]}]},{"type":"expand","attrs":{"title":"API configuration"},"content":[{"type":"paragraph","content":[{"text":"The REST API has been extended. To be able to use the latest endpoints, the following steps should be taken on the file /api.properties:","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following lines under handler 82 to enable the new officers endpoint:","type":"text"}]},{"type":"codeBlock","content":[{"text":"handler.100.filter = officers\nhandler.100.format = api/officers-details","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following lines under handler 11 to enable remove certificates endpoint:","type":"text"}]},{"type":"codeBlock","content":[{"text":"# Remove certificates\nhandler.12.filter = certificates/remove\nhandler.12.format = api/certificates-remove","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following lines under handler 12 to enable remove subjects endpoint:","type":"text"}]},{"type":"codeBlock","content":[{"text":"# Remove subjects\n handler.13.filter = certificates/remove-subjects\n handler.13.format = api/certificates-remove-subjects","type":"text"}]}]},{"type":"expand","attrs":{"title":"Distribution Point configuration"},"content":[{"type":"paragraph","content":[{"text":"The Distribution Point has been extended. To be able to use the latest configurations, the following steps should be taken on the file /dp.properties:","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following parameter description under the ","type":"text"},{"text":"cxfile","type":"text","marks":[{"type":"strong"}]},{"text":" parameter:","type":"text"}]},{"type":"codeBlock","content":[{"text":"# delta - optional, determines if this handler should fetch the latest\n# Delta CXL from the CXL procedure. Valid values are 'true' or 'false'.\n# Default value: false","type":"text"}]}]},{"type":"expand","attrs":{"title":"WinEP configuration"},"content":[{"type":"paragraph","content":[{"text":"The following handler needs to be added to the end of the file /winep.properties:","type":"text"}]},{"type":"codeBlock","content":[{"text":" handler.99.filter = Revoke\n handler.99.format = winep-revoke\n handler.99.requiredRoRoles = cert.revoke\n handler.99.tokenprocedure =","type":"text"}]}]},{"type":"expand","attrs":{"title":"ACME configuration"},"content":[{"type":"paragraph","content":[{"text":"The ACME configuration has been extended with additional options. To be able to use the latest features, the following steps should be taken on the file /acme.properties:","type":"text"}]},{"type":"paragraph","content":[{"text":"Add the following new parameter description to the end of the ","type":"text"},{"text":"Parameters","type":"text","marks":[{"type":"strong"}]},{"text":" section:","type":"text"}]},{"type":"codeBlock","content":[{"text":"# publicationProcedure - The publication procedure name that will be triggered\n# from CF upon certificate revocation","type":"text"}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"4. Replace .war file","type":"text"}]},{"type":"expand","attrs":{"title":"Replace .war file"},"content":[{"type":"paragraph","content":[{"text":"Replace the Protocol Gateway ","type":"text"},{"text":".war","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" file: ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"pgwy.war","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" in the ","type":"text"},{"text":"webapps","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" folder with the new version.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"5. Restart the Tomcat service","type":"text"}]}],"version":1}

Browser not supported