Installation for Data Engineering

10.5.7
- 10.5.6
- 10.5.5.1
- 10.5.5
- 10.5.4
- 10.5.3
- 10.5.2
- 10.4.1
- 10.4.0

Back Next

Set Up a Keystore File

When you install the Informatica services, you can configure secure communication for the domain and set up a secure connection to Informatica Administrator (the Administrator tool). If you configure these security options, you must set up keystore and truststore files.

Before you install the Informatica services, set up the files for secure communication within the Informatica domain or for a secure connection to the Administrator tool. To create the required files, you can use the following programs:

keytool: You can use keytool to create an SSL certificate or a Certificate Signing Request (CSR) as well as keystores and truststores in JKS format.
OpenSSL: You can use OpenSSL to create an SSL certificate or CSR as well as convert a keystore in JKS format to PEM format.; For more information about OpenSSL, see the documentation on the following website: https://www.openssl.org/docs/

For a higher level of security, send your CSR to a Certificate Authority (CA) to get a signed certificate.

The software available for download at the referenced links belongs to a third party or third parties, not Informatica. The download links are subject to the possibility of errors, omissions or change. Informatica assumes no responsibility for such links and/or such software, disclaims all warranties, either express or implied, including but not limited to, implied warranties of merchantability, fitness for a particular purpose, title and non-infringement, and disclaims all liability relating thereto.

Secure Communication Within the Informatica domain

Before you enable secure communication within the Informatica domain, verify that the following requirements are met:

You created a certificate signing request (CSR) and private key.: You can use keytool or OpenSSL to create the CSR and private key.; Note that RSA encryption requires more than 512 bits.

You have a signed SSL certificate.: The certificate can be self-signed or CA signed. Informatica recommends a CA signed certificate.

You imported the certificate into keystores.: You must have a keystore in PEM format named
infa_keystore.pem
and a keystore in JKS format named
infa_keystore.jks
.; The keystore files must contain the root and intermediate SSL certificates.; The password for the keystore in JKS format must be the same as the private key pass phrase used to generate the SSL certificate.

You imported the certificate into truststores.: You must have a truststore in PEM format named
infa_truststore.pem
and a truststore in JKS format named
infa_truststore.jks
.; The truststore files must contain the root, intermediate, and end user SSL certificates.

Import the certificate files one time and then copy them to all machines that host the Data Integration Service and Metadata Access Service. If the Data Integration Service runs on a grid, mappings that you push to the Hadoop environment can fail with initialization errors due to inconsistent binary hex values.

The keystores and truststores are in the correct directory.: The keystore and truststore must be in a directory that is accessible to the installer.
The keystore type used for the Administrator tool determines the keystore types for the Content Management Service.: If you used the default keystore certificate for the Administrator tool, you can use either the default or a custom keystore certificate for the Content Management Service.

If you used a custom keystore certificate for the Administrator tool, you must use a custom keystore certificate for the Content Management Service.

For more information about how to create a custom keystore and truststore, see the Informatica How-To Library article "How to Create Keystore and Truststore Files for Secure Communication in the Informatica Domain".

Secure Connection to the Administrator tool

Before you secure the connection to the Administrator tool, verify that the following requirements are met:

You created a certificate signing request (CSR) and private key.: You can use keytool or OpenSSL to create the CSR and private key.; Note that RSA encryption requires more than 512 bits.

You have a signed SSL certificate.: The certificate can be self-signed or CA signed. Informatica recommends a CA signed certificate.

You imported the certificate into a keystore in JKS format.: A keystore must contain only one certificate. If you use a unique certificate for each web application service, create a separate keystore for each certificate. Alternatively, you can use a shared certificate and keystore.; If you use the installer-generated SSL certificate for the Administrator tool, you do not need to import the certificate into a keystore in JKS format.

The keystore is in the correct directory.: The keystore must be in a directory that is accessible to the installer.

Rename Saved Search

Table of Contents

Installation for Data Engineering

Installation for Data Engineering

Set Up a Keystore File

Set Up a Keystore File

Secure Communication Within the Informatica domain

Secure Connection to the Administrator tool