How to obtain and add the SSL Certificate PEM to NetWitness's truststore to connect to HTTPS enabled Feed Servers (recurring feeds)

Issue

When attempting to validate a URL on the NetWitness Recurring Feed wizard interface, you get a message similar to this:

And messages similar to this in /var/netwitness/uax/logs/sa.log:

OR 

This is because the certificate for the Feed Repo server has not been imported to NetWitness' jetty cacerts truststore.

Tasks

Before importing into the NetWitnesds jetty cacerts truststore, you must first obtain the server's PEM certificate file, either from the system owner, or you may attempt to manually retrieve it using openssl. Below is an example of how to do so with the "openssl" utility, using https://google.com as an example:

Command: 

Output: 

In the above example, we want to take the first certificate and copy it to it's own file. This would be the portion that begins with "-----BEGIN CERTIFICATE-----" and ends with "-----END CERTIFICATE-----"

For example:

Save that to a file on the Admin Server/Node-Zero under /root/ as:

"import-cert-hostname.pem"

Inspect the cert with openssl to ensure it was extracted properly:

Note that the Certificate dates must be within range, and the CN or  Subject Alternative Name must match the destination host name you'll be using in the Recurring Feed's wizard. 

Once you have the certificate in the appropriate PEM format, move on to the Resolution steps below

Resolution

• Take a backup of the cacerts file:
  
  cp /etc/pki/ca-trust/extracted/java/cacerts /etc/pki/ca-trust/extracted/java/cacerts.BAK
   
• Note how many current certificates are currently in the cacerts file with this command:
  
  [root@NEW-NW11-NW-NODE-ZERO ~]# keytool -list -keystore /etc/pki/ca-trust/extracted/java/cacerts -storepass changeit | wc -l
Warning: use -cacerts option to access cacerts keystore
307
  
  
  • In the above scenario, I have 307 entries
• Import your new certificate from your PEM file. Be sure to add an alias so it's easy to confirm. The Alias is simply a friendly name and does not need to match the hostname. It will ask you to type "yes" to confirm:
  
  keytool -import -file /root/import-cert-google.pem -alias LabGoogleTest -keystore /etc/pki/ca-trust/extracted/java/cacerts -storepass changeit
.
.
.
.
.
9: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName: www.google.com
]

#10: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: D6 F9 80 D4 EA 2E A7 14 6A 7B 48 FA F1 9E E1 98 ........j.H.....
0010: C3 6A B2 4F .j.O
]
]

Trust this certificate? [no]: yes
Certificate was added to keystore

  
  
  
• Check again to see if the count of certs has incremented:
  
  [root@NEW-NW11-NW-NODE-ZERO ~]# keytool -list -keystore /etc/pki/ca-trust/extracted/java/cacerts -storepass changeit | wc -l
Warning: use -cacerts option to access cacerts keystore
309

  
  
  
  • Note that I have 309 now
• You can also look for the Alias:
  
  [root@NEW-NW11-NW-NODE-ZERO ~]# keytool -list -keystore /etc/pki/ca-trust/extracted/java/cacerts -storepass changeit | grep -i labgoogletest
Warning: use -cacerts option to access cacerts keystore
labgoogletest, Jun 23, 2025, trustedCertEntry,
• Restart jetty:
  
  systemctl restart jetty

Once Jetty is back up, you should be able to successfully connect and retrieve the feed from your feed server via the Recurring Feed Wizard. 

Product Details

NetWitness Product Set: NetWitness Logs & Network
NetWitness Product/Service Type: NetWitness Content, Feeds, Live
NetWitness Version/Condition: 12.x
Platform: CentOS , AlmaLinux

Approval Reviewer Queue

Technical approval queue