The SSL/TLS protocol uses public key cryptography to encrypt and decrypt network traffic. The public key used to encrypt and decrypt traffic is stored in an SSL certificate that can be self-signed or signed. A self-signed certificate is signed by the creator of the certificate. Because the identity of the signer is not verified, a self-signed certificate is less secure than a signed certificate. A signed certificate is an SSL certificate that has the identity of the person who requested the certificate verified by a certificate authority (CA). Informatica recommends CA signed certificates for a higher level of security.

A keystore contains private keys and certificates. It is used to provide a credential. A truststore contains the certificate of trusted SSL/TLS servers. It is used to verify a credential.

To secure connections in the domain, Informatica requires keystores and truststores in PEM and JKS formats. You can use the following programs to create the required files:

keytool

You can use the Java keytool key and certificate management utility to create an SSL certificate or a certificate signing request (CSR) as well as keystores and truststores in JKS format.

The keytool utility is available in the following directory on domain nodes:

<Informatica installation directory>\java\bin

If the domain nodes run on AIX, you can use the keytool provided with the IBM JDK to create an SSL certificate or a Certificate Signing Request (CSR) as well as keystores and truststores.

OpenSSL

You can use OpenSSL to create an SSL certificate or CSR as well as convert a keystore in JKS format to PEM format.

For more information about OpenSSL, see the documentation on the following website:

https://www.openssl.org/docs/

The type of connection that you secure determines the files required.