The SSL/TLS protocol uses public key cryptography to encrypt and decrypt network traffic. The public key used to encrypt and decrypt traffic is stored in an SSL certificate that can be self-signed or signed. A self-signed certificate is signed by the creator of the certificate. Because the identity of the signer is not verified, a self-signed certificate is less secure than a signed certificate. A signed certificate is an SSL certificate that has the identity of the person who requested the certificate verified by a certificate authority (CA). Informatica recommends CA signed certificates for a higher level of security.

A keystore contains private keys and certificates. It is used to provide a credential. A truststore contains the certificate of trusted SSL/TLS servers. It is used to verify a credential.

To secure connections in the domain, Informatica requires keystores and truststores in PEM and JKS formats. You can use the following programs to create the required files:

keytool

Use keytool to create an SSL certificate or a Certificate Signing Request (CSR) as well as keystores and truststores in JKS format.

For more information about keytool, see the documentation on the following website:

http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html

OpenSSL

You can use OpenSSL to create an SSL certificate or CSR as well as convert a keystore in JKS format to PEM format.

For more information about OpenSSL, see the documentation on the following website:

https://www.openssl.org/docs/

The type of connection that you secure determines the files required.