Implementing TLS Security in a PowerExchange Network

Back Next

Step 3D. Configure the DBMOVER File on the Linux, UNIX, or Windows TLS Server

Depending on how you want to configure TLS processing, you must include some or all of the following statements in the DBMOVER file on the Linux, UNIX, or Windows TLS server:

LISTENER. Specifies the parameters for the PowerExchange Listener that is operating in TLS mode.

SSL. Specifies the security key and passphrase that you are using to make the TLS connection. If the server requests client authentication, also specifies the certificate authority list (CALIST).

SSL_REQ_CLNT_CERT. Specifies whether the OpenSSL library verifies that the issuer of the remote server subject certificate is a locally trusted CA certificate specified in the SSL CALIST or CAPATH parameter. Set this parameter to Y if the following conditions are true:

You need to verify the identify of the remote machine. For example, another machine might be impersonating a client on your network.

You have or your security administrator has a technical understanding of certificates and can coordinate the locally trusted CA certificates with the remote client subject certificates.

You have a PowerExchange process that runs on Linux, Unix or Windows. For example, you are accessing Oracle, Microsoft SQL Server, DB2 UDB or MySQL data.

SSL_ALLOW_SELFSIGNED. Specifies whether to allow self-signed certificates if the server requests client authentication. Set this statement to Y if certificate verification is performed, and the OpenSSL library rejects the local CA certificate. If SSL_REQ_CLIENT_CERT is set to Y, the OpenSSL library rejects self-signed CA certificates by default. A CA certificate is considered trusted if it is present in the location specified by the SSL CALIST or CAPATH parameters.

In general, only a single CA certificate is required. However, if a chain of certificates is included, the bottom certificate may be self-signed.

If the local CA certificate is rejected once, it will also fail for all other incoming connection attempts.

The following DBMOVER statements configure TLS communication:

LISTENER=(node,TCPIP,port_number,,,,,,,SSL)
SSL=(PASS=passphrase,KEY=personalkey.pem),CALIST=calist
SSL_REQ_CLNT_CERT=Y

You might want to run the Listener in both TLS and non-TLS mode. For example, you could run the Listener in non-TLS mode on port 13131 to connect to the PowerExchange Navigator and PowerCenter Developer, and run the Listener in TLS mode on port 13132 to connect to the PowerCenter Integration Service. In this case, the DBMOVER file would include the following LISTENER statements:

LISTENER=(node1,TCPIP,13131)
LISTENER=(node1,TCPIP,13132,,,,,,,SSL)

Rename Saved Search

Table of Contents

Implementing TLS Security in a PowerExchange Network

Implementing TLS Security in a PowerExchange Network

Step 3D. Configure the DBMOVER File on the Linux, UNIX, or Windows TLS Server

Step 3D. Configure the DBMOVER File on the Linux, UNIX, or Windows TLS Server