Skip to end of metadata
Go to start of metadata

The steps that were followed to generate certificates to be used to deploy the CMSO Spring Boot services in OOM with HTTPS enabled in Windriver Lab. This assumes you already have access to the Windriver Lab.

Updating the oof.onap Certificate in AAF 

In order to access AAF you will need to update your /etc/hosts file (C:\Windows\System32\drivers\etc\hosts on Windows)

Note that the IP can change. Not sure how to find out where it is running when it does. Found it here, but this could change too (wink)

Navigating to the AAF Certificate 

From here:

Or, if you want the oof.onap certificate, just click on

Downloading the AAF certificate Artifacts

This must be done from a host that can run docker and has it's etc hosts updated as above:

This is the Reader's Digest version of

Running will prompt for many arguments which will be stored in ./aaf.props file. Subsequent executions of will pull the values from aaf.props so if you need to change a value, it should be done in aaf.props (or delete it and start over) will run a docker image which will download all the artifacts to the Directory /opt/app/osaaf/local in the docker image.

The Application FQDN is the FQDN * oof.onap so we will add our Windriver lab VPN IP that to our /etc/hosts file as well oof.onap

On Unix host, run ifconfig while connected to the VPN

ifconfig -a|grep 10.12
inet --> netmask 0xffffffff

These files will not be accessible by default when the script is done because it is going to a docker volume that is in the VOLUME attribute in aaf.props. For some reason, the script does not allow the VOLUME to be a local folder. The docker volume will automatically be created, in the case below docker volume cert (volume can be any name) created with the local driver.

WIth luck this will have generated all of the artifacts in the docker cert volume:

Retrieving the artifacts from the docker volume

Note that when we retrieve the artifacts, the various passwords will be encrypted and can only be unencrypted by cadi. The cadi showpass command expects the artifacts to be in /opt/app/osaaf/local folder, so the following command can be used to put the files from the cert docker volume into your local /opt/app/osaaf/local folder.

Important note on the Mac, had to update the docker preferences to include /opt/app as a mountable folder.

sudo docker run -v /opt/app/osaaf:/tmp/osaaf -v cert:/opt/app/osaaf/local ubuntu cp -rf /opt/app/osaaf/local/local /tmp/osaaf

In essence the above runs a docker container (ubuntu) with the docker cert volume mounted and the local /opt/app/osaaf/local folder mounted as a different volume so we can copy the artifacts from the docker volume to our local host.

Retrieving the artifact passwords

The can be used to decrypt  the passwords in the org.onap.oof.cred.props file.

There are several things to address. 

  1. Copy the truststoreONAPall.jks to the folder
  2. Make sure the CADI jar is in the local folder. You will get this error: For local use, you need to have 'aaf-cadi-aaf-2.1.12-SNAPSHOT-full.jar'
  3. The AAF account you are using needs to have showpass privieges in AAF, so we added those privileges to the admin role in the namespace

For 1:

cp /opt/app/osaaf/local/truststoreONAPall.jks ./

For 2: 

I had a local version that was different than the version in so I copied the jar I had to the folder and updated VERSION in aaf.props

For 3:

So finally you can run

bash local showpass oof.onap

This will prompt for password which is the default demo123456!

Note that if you fat finger the password you get a goofy error 

org.onap.aaf.cadi.CadiException: org.onap.aaf.cadi.LocatorException: No Entries found for ''

which can send you on a wild goose chase. 

Not sure why I bothered to obscure the passwords (wink)

Using certificates with Spring Boot Application

  1. Copy these 2 artifacts to a folder accessible to your application 
    1. truststoreONAPall.jks (for outgoing HTTPS requests)
    2. org.onap.<app>.jks (i.e. org.onap.oof.jks) (for incoming HTTPS requests)
  2. Add the following to the JVM args
    1. -Dserver.ssl.key-store=<folder>/org.onap.oof.jks
    2. -Dserver.ssl.key-store-password=<cadi_keystore_password_jks>

  • No labels


  1. Hello, 

    Thank you very much for this tutorial

    Trying to do the same for extapi, do you know login/password to use or from where we can get those credentials to access to

    1. Hi, 

      try aaf_admin/demo123456!

      1. Excellent ! Thank so much !

      2. I am trying on windriver with aaf_admin, but even on the oof namespace I can not see any of the certificates listed in your screenshot. I am probably not doing things correctly, or understand how aaf work

  2. Hi,

    Is there any way we can logout in aaf gui.