Security Guide

Back Next

Configure the Informatica Domain with a New Effective List of Cipher Suites

To configure the cipher suites that the Informatica domain uses, you must update the Informatica domain, all gateway nodes, and all worker nodes with the same whitelist and blacklist.

Changes to the blacklist, whitelist, and effective list are not cumulative. Informatica creates a new effective list based on the blacklist, default list, and whitelist when you run the command. The new effective list overwrites the previous list.

To configure an existing Informatica domain with a new effective list of cipher suites, perform the following steps:

Shutdown the Informatica domain.

Optionally, run the infasetup listDomainCiphers command to view the lists of cipher suites that a domain or node supports or blocks.

For example, run the following command to view all the cipher suite lists:

infasetup listDomainCiphers -l ALL -dc true

Run the infasetup updateDomainCiphers command on a gateway node and specify a whitelist, blacklist, or both.

For example, run the following command to add one cipher suite to the effective list and remove two cipher suites from the effective list:

infasetup updateDomainCiphers -cwl TLS_DHE_DSS_WITH_AES_128_CBC_SHA -cbl TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA

Run the infasetup updateGatewayNode command on each gateway node and specify a whitelist, blacklist, or both.

Use the same whitelist and blacklist as the domain.

For example, run the following command:

infasetup updateGatewayNode -cwl TLS_DHE_DSS_WITH_AES_128_CBC_SHA -cbl TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA

Update each worker node with the same set of cipher suites as the Informatica domain.

Use the same whitelist and blacklist as the domain.

For example, run the following command:

infasetup updateWorkerNode -cwl TLS_DHE_DSS_WITH_AES_128_CBC_SHA -cbl TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA

Start the Informatica domain.

Optionally, run the infacmd isp listDomainCiphers command to view the lists of cipher suites that a domain or node uses.

For example, run the following command to view the effective list of cipher suites that the domain uses:

infacmd isp listDomainCiphers -l EFFECTIVE

Rename Saved Search

Table of Contents

Security Guide

Security Guide

Configure the Informatica Domain with a New Effective List of Cipher Suites

Configure the Informatica Domain with a New Effective List of Cipher Suites