Security Guide

10.4.1
- 10.5.5
- 10.5.4
- 10.5.3
- 10.5.2
- 10.5.1
- 10.5

Back Next

Requirements for Secure Communication within the Domain

Before you enable secure communication within the domain, ensure that the following requirements are met:

You created a certificate signing request (CSR) and private key.: You can use keytool or OpenSSL to create the CSR and private key.; If you use RSA encryption, you must use more than 512 bits.

You have a signed SSL certificate.: The certificate can be self-signed or CA signed. Informatica recommends a CA signed certificate.

You imported the certificate into keystores.: You must have a keystore in PEM format named
infa_keystore.pem
and a keystore in JKS format named
infa_keystore.jks
.; The keystore files must contain the root and intermediate SSL certificates.; The password for the keystore in JKS format must be the same as the private key pass phrase used to generate the SSL certificate.

You imported the certificate into truststores.: You must have a truststore in PEM format named
infa_truststore.pem
and a truststore in JKS format named
infa_truststore.jks
.; The truststore files must contain the root, intermediate, and end user SSL certificates.

The keystores and truststores are in the correct directory.: If you enable secure communication during installation, the keystore and truststore must be in a directory that is accessible to the installer.; If you enable secure communication after installation, the keystore and truststore must be in a directory that is accessible to the command line programs.

You enforced the HTTP Strict Transport Security (HSTS) response header.: You can use this option after you apply the Informatica 10.4.1.2 service pack.
You can choose to enable HSTS response header in your domain to prevent man-in-the-middle (MITM) security threats. If you enable HSTS response header, you can stop HTTP redirects to HTTPS and ensure that only secured URLs (HTTPS) are accessed.; Informatica supports multiple applications and services running on both HTTP and HTTPS. If you enable this option, you cannot access the applications or services with HTTP URL.; To enable this option, set the INFA_HSTS_HEADER_ENABLED environment variable to
true
and import the certificates from
infa_truststore
and Informatica Administrator keystore to your browser.

Guidelines for Using Default and Custom Truststore Files

The installer places the default infa_truststore.jks and keystore files in the

<Informatica installation directory>/services/shared/security

directory on each node. You can use the default truststore for setup and proof-of-concept, but the default truststore and keystore files provide limited security. For production, Informatica recommends using custom truststore and keystore files for more secure communication and SAML authentication.

Place custom truststore and keystore files in a custom directory. The truststore file name must be

infa_truststore.jks

Do not overwrite, delete or move the default files. the default truststore and keyst.ore files. Do not place custom truststore and keystore files in the

<Informatica installation directory>/services/shared/security

Guidelines for Creating Certificates and Custom Truststore and Keystore Files

You can use the Java keytool key and certificate management utility to create an SSL certificate or a certificate signing request (CSR) as well as keystores and truststores in JKS format.

The keytool is available in the following directory on domain nodes:

<Informatica installation directory>\java\bin

If the domain nodes run on AIX, you can use the keytool provided with the IBM JDK to create an SSL certificate or a Certificate Signing Request (CSR) as well as keystores and truststores:

Copy the certificate files to a local folder on a gateway node within the Informatica domain.

From the command line, go to the location of the keytool utility on the node.

Run the keytool utility to import the certificate.

Restart the node.

Next Steps

For more information about how to create a custom keystore and truststore and import certificates in your browser, see the Informatica How-To Library article How to Create Keystore and Truststore Files for Secure Communication in the Informatica Domain: https://docs.informatica.com/data-integration/shared-content-for-data-integration/h2l/how-to-create-keystore-and-truststore-files-for-secure-communica/abstract.html

After you secure the domain, configure the Informatica client applications to work with a secure domain.

Rename Saved Search

Table of Contents

Security Guide

Security Guide

Requirements for Secure Communication within the Domain

Requirements for Secure Communication within the Domain

Guidelines for Using Default and Custom Truststore Files

Guidelines for Creating Certificates and Custom Truststore and Keystore Files

Next Steps