Secure Domain Communication
The Informatica domain has various options to secure the data and metadata that are transmitted between the Service Manager and services in the domain and the client applications. Informatica uses the TCP/IP and HTTP protocols to communicate between components in the domain and uses SSL certificates to secure the communication between services and the Service Manager in the domain.
The SSL/TLS protocol uses public key cryptography to encrypt and decrypt network traffic. The public key used to encrypt and decrypt traffic is stored in an SSL certificate that can be self-signed or signed. A self-signed certificate is signed by the creator of the certificate. Because the identity of the signer is not verified, a self-signed certificate is less secure than a signed certificate. A signed certificate is an SSL certificate that has the identity of the person who requested the certificate verified by a certificate authority (CA). Informatica recommends CA signed certificates for a higher level of security.
A keystore contains private keys and certificates. It is used to provide a credential. A truststore contains the certificate of trusted SSL/TLS servers. It is used to verify a credential.
To secure connections in the domain, Informatica requires keystores and truststores in PEM and JKS formats. You can use the following programs to create the required files:
- Use keytool to create an SSL certificate or a Certificate Signing Request (CSR) as well as keystores and truststores in JKS format.
- For more information about keytool, see the documentation on the following website:
- You can use OpenSSL to create an SSL certificate or CSR as well as convert a keystore in JKS format to PEM format.
- For more information about OpenSSL, see the documentation on the following website:
The type of connection that you secure determines the files required.