Install Certificate Manager Web UI | Nexus Certificate Manager

This article describes how to install and configure the Web UI component in Nexus Certificate Manager.

See Certificate Manager Web UI communication flow for a detailed description of the communication between system components.

Prerequisites

Certificate Manager (CM 8.15.1) is installed. See Nexus Certificate Manager.
Protocol Gateway (PGWY) is installed and configured. See Install Protocol Gateway.
- PGWY officer (VRO) roles should have “use client” only.
- CM REST API configuration in Protocol Gateway. See Configure REST API in Protocol Gateway.
Verify the supported Personal Desktop Client is installed see Instruction to install Personal Desktop client on windows.
- If required place the windows.zip file under \Tomcat 10.1\webapps\webui\webui\files\
Hermod is configure with basic setup and up.
- Check response “Plugout Message Server” https://<server-dns>:20400/hermod/rest/ms

You must configure Protocol Gateway for external authentication against Hermod to use CM Web UI.
Assigning other roles to PGWY officer may override the roles & privileges of client WebUI officer.

Prefer container-based setup for Hermod.

The latest version supports Tomcat 11 and Java 25 therefore have a separate supportive installation of Java and Tomcat for .war setup; see Instructions to Install Hermod.

Setup HERMOD with PGWY

Verify that prerequisites required endpoints are configured and responding.
1. CM SDK connectivity from PGWY to CM is working, server DNS is configured in TLS cert.
2. Verify that PGWY Officer used for client authentication has limited required roles assigned “use client”.
3. Protocol Gateway (PGWY) ping responding https://<server-dns>:8443/pgwy/ping

Handshaking, Create Hermod TLS certificate and P12.

In tomcat/server.xml add Connector port="20400" add TLS p12 file in conf folder of tomcat - (path to add in server.xml of tomcat)



<--- HERMOD settings--->
<Connector port="20400"
	protocol="org.apache.coyote.http11.Http11NioProtocol"
	SSLEnabled="true"
	defaultSSLHostConfigName="localhost"
	maxThreads="150"
	scheme="https"
	secure="true">
 <SSLHostConfig
    sslProtocol="TLS"
    protocols="TLSv1.2,+TLSv1.3"
	hostName="localhost"
	truststoreFile="conf/new_tls.jks"
	truststorePassword="1234"
	certificateVerification="none">
<Certificate
	certificateKeystoreFile="conf/hermodTLS.p12"
	certificateKeystorePassword="1234"
	certificateKeystoreType="PKCS12"/>
</SSLHostConfig>
</Connector>

Add boot and issuing CA cert to trust store JKS and java security

  keytool -importcert -alias bootcaB -cacerts -storepass changeit -file cacerts/<your_cert.cer>

Officer & Personal Desktop setup

Issue CM Officer Token using Registration Authority (RA) client.
1. Create a token (webuiAuth.p12) or prepare a smartcard.
Create an Officer Profile(Webui Officer Profile) using AWB client.
1. With roles “Issue certificates”, “Revoke certificates” and “use clients”.
Create an Officer (Webui Officer)
1. Add profile (Webui Officer Profile)
2. Add the issued certificate in step 1 to the officer object (webuiAuth.p12 certificate).
Steps in Personal Desktop app.
1. Import the Officer.p12 and add issuing CA certificate to OS trust store.
2. Or connect smart card.

Required Configurations

Open Ports 8080, 8443, 20400 and set connectors in Server.xml

HTML

<Connector port="8080" protocol="HTTP/1.1"
    connectionTimeout="20000"
    redirectPort="8443"
    maxParameterCount="1000"/>
  
<--- PWGY settings--->
<Connector port="8443"
	protocol="org.apache.coyote.http11.Http11NioProtocol"
	maxThreads="150" SSLEnabled="true">
<SSLHostConfig
	honorCipherOrder="true"
	ciphers="HIGH:!3DES:!DES:!SHA1:!SHA256:!SHA384:!SEED"
	protocols="TLSv1.3,TLSv1.2"
	truststoreFile="conf/new_tls.jks"
	truststorePassword="1234"
	certificateVerification="none">
<Certificate
	certificateKeystoreFile="conf/PGWYTLS.p12"
	certificateKeystorePassword="1234"
	certificateKeystoreType="PKCS12"
	type="RSA" />
</SSLHostConfig>
</Connector>
  
<--- HERMOD settings--->
<Connector port="20400"
	protocol="org.apache.coyote.http11.Http11NioProtocol"
	SSLEnabled="true"
	defaultSSLHostConfigName="localhost"
	maxThreads="150"
	scheme="https"
	secure="true">
 <SSLHostConfig
	hostName="localhost"
	sslProtocol="TLS"
    protocols="TLSv1.2,+TLSv1.3"
	truststoreFile="conf/new_tls.jks"
	truststorePassword="1234"
	certificateVerification="none">
<Certificate
	certificateKeystoreFile="conf/hermodTLS.p12"
	certificateKeystorePassword="1234"
	certificateKeystoreType="PKCS12"/>
</SSLHostConfig>
</Connector>

generate client details X-API-Key to add in application.yaml and auth.properties

Generate client details X-API-Key https://<server-DNS>:20400/hermod/rest/util/generateclient/pgwy-auth

Add to application yaml

windows tomcat .war setup path: \Tomcat\webapps\hermod\WEB-INF\classes\

  hermod:
    allowed-clients:
      # X-Api-Key: Y2xpZW50OjU1NmYxODI4NmM5NjQzMDY5MWJhN2VlYjJiODgzMmQ3NzExMjI1NTM5YTdmNDljMmEzMmVkZWNjM2Q0NjI4ZjI=
      - client-id: pgwy-auth
        key: 0e12b3a181c447f1b7d1745858d8583e197743db5663447a9cd99b5d7548b18c
        # Optional username:password to be supplied for basic authentication in callbacks
        # callback-basic-auth: username:password
        # The callback URL base for this specific client
        callback-url: https://<server-DNS>:8443/pgwy/auth/callback

Add Xapi key to auth.prop

Set start = true

default.authservice.apikey = x-api -key here
default.authservice.apiurl = https://<server-DNS>:20400/hermod/rest

Example configuration required for Application.yml

 ### application.yaml  ###   
location: \webapps\hermod\WEB-INF\classes\...
check these sections in application yaml 
---------
server:
  port: 20400
  servlet:  
    context-path: /hermod
    
  ssl:
    # This could be false as ssl is handled in tomcat 20400 port https
    enabled: true 
    key-store: C:/Program Files/Apache Software Foundation/Tomcat 10.1/certificates/hermodTLS.p12
    key-store-password: "1234"
    key-store-type: PKCS12    
--------------
application:

  hermod:
    allowed-clients:
      # X-Api-Key: Y2xpZW50OjU1NmYxODI4NmM5NjQzMDY5MWJhN2VlYjJiODgzMmQ3NzExMjI1NTM5YTdmNDljMmEzMmVkZWNjM2Q0NjI4ZjI=
      - client-id: pgwy-auth
        key: 0e12b3a181c447f1b7d1745858d8583e197743db5663447a9cd99b5d7548b18c
        # Optional username:password to be supplied for basic authentication in callbacks
        # callback-basic-auth: username:password
        # The callback URL base for this specific client
        callback-url: https://<server-DNS>:8443/pgwy/auth/callback
-----------------
    message-server-library:
      public-url: https://<server-DNS>:20400/hermod/rest/ms
-----------------

Install and deploy WAR file for CM Web UI

Download cm-web-ui-2.0.2.zip from the Nexus support portal.
Unzip and copy webui.war to the "Tomcat/webapps" subdirectory of the Tomcat installation.
Restart Tomcat check logs.
verify that CM-WEBUI is available at https://<server-DNS>>:8443/webui and authenticate using officer.

Last updated: October 22, 2026