Administrator Guide

10.4.1
- 10.5.7
- 10.5.6
- 10.5.2
- 10.5.1
- 10.5
- 10.4.0
- 10.2.2 HotFix 1
- 10.2.2 Service Pack 1
- 10.2.2
- 10.2.1

Back Next

Import Security Certificates from an SSL-Enabled Cluster

When you use custom, special, or self-signed security certificates to secure the Hadoop cluster, Informatica services that connect to the cluster require these certificates to be present on the machines that run the application services. Use the

keytool

utility to import certificates from the cluster.

For more information about the

keytool

utility, refer to the Oracle documentation.

If a MapR cluster is SSL-enabled, you do not have to import the security certificates. Make sure that the MapR client on the Data Integration Service and Metadata Access Service machines is configured to access an SSL-enabled cluster.

If a cluster uses SSL, import security certificates from the cluster to the Data Integration Service and Metadata Access Service machines.

Run the following

keytool -exportcert

command on the cluster to export the certificates:

keytool -exportcert 
-alias <alias name> 
-keystore <custom.truststore file location> 
-file <exported certificate file location> 
-storepass <password>

Where:

-alias

specifies the alias name associated with the truststore file.

-keystore

specifies the location of the truststore file on the cluster.

-file

specifies the file name and location for the exported certificate file.

-storepass

specifies the password for the keystore on the cluster.

The

keytool -exportcert

command produces a certificate file associated with the alias.

Run the following

keytool -importcert

command on one Data Integration Service machine to import the security certificates:

keytool -importcert -trustcacerts 
-alias <alias name> 
-file <exported certificate file location> 
-keystore <java cacerts location> 
-storepass <password>

Where:

-alias

specifies the alias name associated with the certificate file.

-file

specifies the file name and location of the exported certificate file.

-keystore

specifies the location of the truststore file on the domain.

-storepass

specifies the password for the keystore on the domain.

Import the certificate files one time and then copy them to all machines that host the Data Integration Service and Metadata Access Service. If the Data Integration Service runs on a grid, mappings that you push to the Hadoop environment can fail with initialization errors due to inconsistent binary hex values.

Depending on whether the Informatica domain uses SSL, you specify the keystore location as follows:

If the domain is SSL-enabled, import the certificate file to the following location:

<Informatica installation directory>/services/shared/security/infa_truststore.jks

If the domain is not SSL-enabled, import the certificate file to the following location:

<Informatica installation directory>/java/jre/lib/security/cacerts

The

keytool -importcert

command imports the security certificates to the keystore location you specify.

Example. Import Security Certificates

The environment includes a Cloudera CDH cluster that uses SSL and an Informatica domain that does not use SSL. You export the security certificate for the user bigdata_user1 from the custom.keystore on the Cloudera CDH cluster to the file exported.cer. Then, you import the export.cer certificate file to the Informatica domain location.

Run the following export command:

keytool -exportcert -alias bigdata_user1 -keystore ~/custom.truststore -file ~/exported.cer

Run the following import command on the Data Integration Service machine:

keytool -importcert -alias bigdata_user1 -file ~/exported.cer -keystore <Informatica installation directory>/java/jre/lib/security/cacerts

Copy the certificate file to all other machines that host the Data Integration Service and the Metadata Access Service.

Rename Saved Search

Table of Contents

Administrator Guide

Administrator Guide

Import Security Certificates from an SSL-Enabled Cluster

Import Security Certificates from an SSL-Enabled Cluster