Administrator Guide

9.9
- 9.9.4
- 9.9.3
- 9.9.2
- 9.9.1
- 9.8.4
- 9.8.3
- 9.8.2
- 9.8.1
- 9.8.0

Back Next

Example SSL Configuration Process

This example demonstrates the process of enabling and configuring SSL communication in Dynamic Data Masking using a custom keystore and truststore.

Stop the Dynamic Data Masking Server.

To convert the Dynamic Data Masking Server port from clear to SSL, run the following command:

server network edit 8195;SSL

Use the keytool command to add a private key and signed certificate to a new keystore. For example, create a self-signed certificate with a 2048-bit RSA key pair, that is valid for 2555 days, under the specified alias in the keystore:

keytool -genkey -trustcacerts -alias myHost -validity 2555 -keyalg RSA -keysize 2048 -keystore keyStore.jceks -storetype JCEKS -storepass keystorePass -dname cn= myHost

Export the signed certificate from the keystore to a file. For example, export a binary DER-encoded certificate from the keystore to the file

myHost.der

keytool -exportcert -noprompt -alias myHost -file myHost.der -keystore keyStore.jceks -storetype JCEKS -storepass keystorePass

Import the certificate file to the truststore. For example, import the certificate from file

myHost.der

under the specified alias myHost:

keytool -importcert -noprompt -trustcacerts -alias myHost -file myHost.der -keystore trustStore.jceks -storetype JCEKS -storepass truststorePass

Copy the keystore to the Dynamic Data Masking Server. For example, run the following command:

copy keyStore.jceks C:\DDM\cfg\

Copy the truststore to the Management Console. For example, run the following command:

copy trustStore.jceks C:\DDM\cfg\

Use one of the following files to configure the keystore in the Dynamic Data Masking Server:

cfg/ddm.security

jvm.params

In the

cfg/client.security

file, configure the truststore you copied to the Management Console.

Start the Dynamic Data Masking Server.

Select

SSL

in the

Secure Layer

menu.

To connect in Dynamic Data Masking versions before 9.8.4, select

None

in the

Secure Layer

menu.

If the handshake with the Dynamic Data Masking Server fails, the command line tool exits with "error code 1" and prints an error message. Check the security configuration files and try again.

To run commands in the local or remote Dynamic Data Masking Server, specify the SSL argument in the connection parameter. For Dynamic Data Masking versions before 9.8.4, do not specify the SSL argument in the connection parameter. For example, in version 9.8.4, run the following command to check the server status:

 server status
 server service add "DDM for ORACLE" -targets admin/admin@127.0.0.1:8195;SSL

Run the following command to check the server status in Dynamic Data Masking versions before 9.8.4:

server status server service add "DDM for ORACLE" -targets admin/admin@127.0.0.1:8195

Rename Saved Search

Table of Contents

Administrator Guide

Administrator Guide

Example SSL Configuration Process

Example SSL Configuration Process