When you install the Informatica services, you can configure secure communication for the domain and set up a secure connection to Informatica Administrator (the Administrator tool). If you configure these security options, you must set up keystore and truststore files.
Before you install the Informatica services, set up the files for secure communication within the Informatica domain or for a secure connection to the Administrator tool. To create the required files, you can use the following programs:
keytool
You can use keytool to create an SSL certificate or a Certificate Signing Request (CSR) as well as keystores and truststores in JKS format.
OpenSSL
You can use OpenSSL to create an SSL certificate or CSR as well as convert a keystore in JKS format to PEM format.
For a higher level of security, send your CSR to a Certificate Authority (CA) to get a signed certificate.
The software available for download at the referenced links belongs to a third party or third parties, not Informatica LLC. The download links are subject to the possibility of errors, omissions or change. Informatica assumes no responsibility for such links and/or such software, disclaims all warranties, either express or implied, including but not limited to, implied warranties of merchantability, fitness for a particular purpose, title and non-infringement, and disclaims all liability relating thereto.
Secure Communication Within the Informatica domain
Before you enable secure communication within the Informatica domain, verify that the following requirements are met:
You created a certificate signing request (CSR) and private key.
You can use keytool or OpenSSL to create the CSR and private key.
If you use RSA encryption, you must use more than 512 bits.
You have a signed SSL certificate.
The certificate can be self-signed or CA signed. Informatica recommends a CA signed certificate.
You imported the certificate into keystores.
You must have a keystore in PEM format named
infa_keystore.pem
and a keystore in JKS format named
infa_keystore.jks
.
The keystore files must contain the root and intermediate SSL certificates.
The password for the keystore in JKS format must be the same as the private key pass phrase used to generate the SSL certificate.
You imported the certificate into truststores.
You must have a truststore in PEM format named
infa_truststore.pem
and a truststore in JKS format named
infa_truststore.jks
.
The truststore files must contain the root, intermediate, and end user SSL certificates.
Import the certificate files one time and then copy them to all machines that host the Data Integration Service and Metadata Access Service. If the Data Integration Service runs on a grid, mappings that you push to the Hadoop environment can fail with initialization errors due to inconsistent binary hex values.
The keystores and truststores are in the correct directory.
The keystore and truststore must be in a directory that is accessible to the installer.
Before you secure the connection to the Administrator tool, verify that the following requirements are met:
You created a certificate signing request (CSR) and private key.
You can use keytool or OpenSSL to create the CSR and private key.
If you use RSA encryption, you must use more than 512 bits.
You have a signed SSL certificate.
The certificate can be self-signed or CA signed. Informatica recommends a CA signed certificate.
You imported the certificate into a keystore in JKS format.
A keystore must contain only one certificate. If you use a unique certificate for each web application service, create a separate keystore for each certificate. Alternatively, you can use a shared certificate and keystore.
If you use the installer-generated SSL certificate for the Administrator tool, you do not need to import the certificate into a keystore in JKS format.
The keystore is in the correct directory.
The keystore must be in a directory that is accessible to the installer.