Configure Certificate Manager Web UI | Nexus Certificate Manager

Prerequisites

Certificate Manager (8.15.1) is installed. See Nexus Certificate Manager.
Protocol Gateway (8.15.1) is installed and configured. See Install Protocol Gateway.
- For CM SDK and client communication have PGWY officer roles should have “use client” only.
- Certificate Manager (CM) REST API configuration in Protocol Gateway. See Configure REST API in Protocol Gateway.
Verify the supported Personal Desktop Client is installed see Instruction to install Personal Desktop client on windows.
- If required place the windows.zip file under \Tomcat 10.1\webapps\webui\webui\files\.
Hermod is configure with basic setup and up.
- check response “Plugout Message Server” https://<server-dns>:20400/hermod/rest/ms

You must configure Protocol Gateway for external authentication against Hermod to use CM Web UI.
Add server DNS to TLS certs for handshake, Hermod and Protocol Gateway to trust.
Assigning other roles to PGWY officer may override the roles & privileges of client WebUI officer.

Setup HERMOD with PWGY

Configure Protocol Gateway for external authentication against Hermod

Verify that prerequisites required endpoints is configured and responding.
1. CM SDK connectivity from PGWY to CM is working, server DNS is configured in TLS cert.
2. Verify that PGWY Officer used for client authentication has limited required roles assigned “use client”.
3. Protocol Gateway (PGWY) ping responding https://<server-dns>:8443/pgwy/ping

Handshaking, Create Hermod TLS certificate and P12.

In tomcat/server.xml add Connector port="20400" add TLS p12 file in conf folder of tomcat - (path to add in server.xml of tomcat)

Open Ports 8080, 8443,20400 and set connectors in server.xml.

<Connector port="8080" protocol="HTTP/1.1"
    connectionTimeout="20000"
    redirectPort="8443"
    maxParameterCount="1000"/>
  
<--- PWGY settings--->
<Connector port="8443"
	protocol="org.apache.coyote.http11.Http11NioProtocol"
	maxThreads="150" SSLEnabled="true">
<SSLHostConfig
	honorCipherOrder="true"
	ciphers="HIGH:!3DES:!DES:!SHA1:!SHA256:!SHA384:!SEED"
	protocols="TLSv1.3,TLSv1.2"
	truststoreFile="conf/new_tls.jks"
	truststorePassword="1234"
	certificateVerification="none">
<Certificate
	certificateKeystoreFile="conf/PGWYTLS.p12"
	certificateKeystorePassword="1234"
	certificateKeystoreType="PKCS12"
	type="RSA" />
</SSLHostConfig>
</Connector>
  
<--- HERMOD settings--->
<Connector port="20400"
	protocol="org.apache.coyote.http11.Http11NioProtocol"
	SSLEnabled="true"
	defaultSSLHostConfigName="localhost"
	maxThreads="150"
	scheme="https"
	secure="true">
 <SSLHostConfig
	hostName="localhost"
	sslProtocol="TLS"
    protocols="TLSv1.2,+TLSv1.3"
	truststoreFile="conf/new_tls.jks"
	truststorePassword="1234"
	certificateVerification="none">
<Certificate
	certificateKeystoreFile="conf/hermodTLS.p12"
	certificateKeystorePassword="1234"
	certificateKeystoreType="PKCS12"/>
</SSLHostConfig>
</Connector>

Add boot and issuing CA cert to trust store JKS and java security

  keytool -importcert -alias bootcaB -cacerts -storepass changeit -file cacerts/<your_cert.cer>

Configure the Hermod integration

Enter the API key from Hermod in the auth.properties file in Protocol Gateway and set the Hermod API URL, generate client details X-API-Key https://<server-DNS>:20400/hermod/rest/util/generateclient/pgwy-auth
Add to application yaml.

windows tomcat .war setup path: \Tomcat\webapps\hermod\WEB-INF\classes\

  hermod:
    allowed-clients:
      # X-Api-Key: Y2xpZW50OjU1NmYxODI4NmM5NjQzMDY5MWJhN2VlYjJiODgzMmQ3NzExMjI1NTM5YTdmNDljMmEzMmVkZWNjM2Q0NjI4ZjI=
      - client-id: pgwy-auth
        key: 0e12b3a181c447f1b7d1745858d8583e197743db5663447a9cd99b5d7548b18c
        # Optional username:password to be supplied for basic authentication in callbacks
        # callback-basic-auth: username:password
        # The callback URL base for this specific client
        callback-url: https://<server-DNS>:8443/pgwy/auth/callback

Add Xapi key to cm-gateway/conf/auth.properties

Set start = true
default.authservice.apikey = x-api -key here
default.authservice.apiurl = https://<server-DNS>:20400/hermod/rest

For details follow the Hermod API integration instructions to set up an integration with Protocol Gateway and specify the callback URL to the Protocol Gateway server. For more information, see Add API user and callback URL in Hermod.

Example application.yaml configuration required for integration with Hermod

 ### application.yaml  ###   
location: \webapps\hermod\WEB-INF\classes\...
check these sections in application yaml 
---------
server:
  port: 20400
  servlet:  
    context-path: /hermod
    
  ssl:
    # This could be false as ssl is handled in tomcat 20400 port https
    enabled: true 
    key-store: C:/Program Files/Apache Software Foundation/Tomcat 10.1/certificates/hermodTLS.p12
    key-store-password: "1234"
    key-store-type: PKCS12    
--------------
application:

  hermod:
    allowed-clients:
      # X-Api-Key: Y2xpZW50OjU1NmYxODI4NmM5NjQzMDY5MWJhN2VlYjJiODgzMmQ3NzExMjI1NTM5YTdmNDljMmEzMmVkZWNjM2Q0NjI4ZjI=
      - client-id: pgwy-auth
        key: 0e12b3a181c447f1b7d1745858d8583e197743db5663447a9cd99b5d7548b18c
        # Optional username:password to be supplied for basic authentication in callbacks
        # callback-basic-auth: username:password
        # The callback URL base for this specific client
        callback-url: https://<server-DNS>:8443/pgwy/auth/callback
-----------------
    message-server-library:
      public-url: https://<server-DNS>:20400/hermod/rest/ms
-----------------

Protocol Gateway automatically detects other instances on the same network using multicast. The multicast group and/or port can be configured if needed and the automatic instance detection can be replaced by (or combined with) a static list of known instance addresses.

You can disable the sharing functionality if only one instance of Protocol Gateway is hosted.

At its minimum, the session sharing mechanism will have to have SSL configured, to ensure secure communication.

Do the following:

Set the connection SSL truststore. Do one of the following:
- Configure the SSL connection with a 'keyfile' using a certificate and key in PKCS#12 file.
- Configure the SSL connection with a subject and by connecting to a HSM with: default.cacheservice.ssl.certificate.subject
  default.cacheservice.ssl.keyfile = vro.p12

Set the SSL keyfile password.

default.cacheservice.ssl.password = 1234

Optional: Disable TCP multicast. This can be useful if using static member list. See default.cacheservice.members.
```
default.cacheservice.multicast = false
```
Optional: Configure TCP multicast port and group. This can be useful if there are several instances of Protocol Gateway on the same network.
```
default.cacheservice.multicastgroup = 224.2.2.3
default.cacheservice.multicastport = 54327
```
Optional: Configure a static list of PGW member nodes. This is an alternative to multicast node discovery when the address and port of the member nodes are known before hand.
```
default.cacheservice.members = localhost:1234,localhost:4321
```

You can disable the sharing functionality if only one instance of Protocol Gateway is hosted.

Configure the cacheservice as a local cache and remove all other cacheservice related configurations.
```
default.cacheservice.factory = com.nexussafe.cm.pgwy.auth.cache.local.LocalCacheServiceFactory
```

Alternative configuration: SSL with PKCS#11

You can configure the sharing of session data to be protected using a SSL encryption certificate in HSM via PKCS#11

Configure the cacheservice to fetch the SSL encryption certificate from the HSM.
```
default.cacheservice.ssl.certificate.subject = Protocol Gateway VRO
```
Configure the cacheservice pin to access the token.
```
default.cacheservice.ssl.password = 1234
```
Configure the cacheservice to specify which PKCS#11 library to use when searching for the SSL encryption certificate and key.
```
default.cacheservice.ssl.pkcs11 = {ProgramFiles}/Personal/Bin/personal.[dll|so]
```

Configure download of Personal Desktop Client

To enable access to CM Web UI, the user must have Personal Desktop Client installed.

As an administrator, you can configure CM Web UI to deliver the installation files for Personal Desktop Client to be downloaded on the sign in page. Do the following:

Go to https://downloads.nexusgroup.com/ and download Personal Desktop Client.
On the Tomcat instance that runs the web UI, navigate to: <tomcat-home>/webapps/webui/files
In the directory, place the installation media for Personal Desktop Client using the following names:
- Windows: windows.zip
- Linux: ubuntu<OS-version>.zip
- MacOS: macosx.zip

The user can now download Personal Desktop Client by clicking the hyperlink Download Personal Desktop Client on the sign in page.

Officer & Personal Desktop setup

Issue CM Officer Token in Registration Authority
1. create a token (webuiAuth.p12) or prepare a smartcard.
In CM AWB create a webui officer
Create an Officer Profile(webui officer profile)
1. With roles “Issue certificates”, “Revoke certificates” and “use clients”.
Create an Officer (webui officer)
1. Add profile (webui officer profile)
2. Add webuiAuth.p12
Steps in Personal Desktop app.
1. Import the Officer.p12 and add issuing CA certificate to OS trust store.
2. Or connect smart card.

Last updated: October 22, 2026

Prerequisites

Setup HERMOD with PWGY

Configure the Hermod integration

Configure session sharing between multiple instances of Protocol Gateway

Alternative configuration: Disabled session sharing

Alternative configuration: SSL with PKCS#11

Configure download of Personal Desktop Client

Officer & Personal Desktop setup