Set up keystore and truststore files for the CDI-PC domain
Set up keystore and truststore files for the
CDI-PC domain
CDI-PC
requires a TLS setup with custom certificates. You can't use the default certificates available with the Informatica domain. Generate keystore and truststore certificates to use with
CDI-PC
. If you use custom certificates that don't include SAN information for host name validation in your Informatica domain, you can't use the same certificates.
Set up files for secure communication within the
CDI-PC domain
and for a secure connection to the Administrator tool and Secure Agent.
CDI-PC
requires certificates configured for host name validation. Ensure that the host name mentioned in the certificate matches the host that you apply it on. To create the required files, you can use the following programs:
keytool
You can use keytool to create a TLS certificate or a Certificate Signing Request (CSR) as well as keystores and truststores in JKS format.
OpenSSL
You can use OpenSSL to create a TLS certificate or CSR as well as convert a keystore in JKS format to PEM format.
For a higher level of security, send your CSR to a Certificate Authority (CA) to get signed certificates. If you use CA-signed certificates, you get a certificate chain with an ordered list of certificates that include the root certificate, one or more intermediate certificates, and the user certificate. Enter all certificates in the chain when you generate the PEM format.
The software available for download at the referenced links belongs to a third party or third parties, not Informatica. The download links are subject to the possibility of errors, omissions or change. Informatica assumes no responsibility for such links and/or such software, disclaims all warranties, either express or implied, including but not limited to, implied warranties of merchantability, fitness for a particular purpose, title and non-infringement, and disclaims all liability relating thereto.
Secure communication within the domain
Before you enable secure communication within the domain, verify that the following requirements are met:
You created a certificate signing request (CSR) and private key.
You can use keytool or OpenSSL to create the CSR and private key.
Note that RSA encryption requires more than 512 bits.
You have a signed TLS certificate.
The certificate can be self-signed or CA signed. Informatica recommends a CA signed certificate.
You imported the certificate into keystores.
Ensure that you have keystores in the following formats:
PEM format, named infa_keystore.pem
JKS format, named infa_keystore.jks
If you use CA-signed certificates, ensure that the keystore files contain the root and intermediate TLS certificates.
Use the same password for the keystore in JKS format and the private key pass phrase used to generate the TLS certificate.
You imported the certificate into truststores.
Ensure that you have truststores in the following formats:
PEM format, named infa_truststore.pem
JKS format, named infa_truststore.jks
Ensure that the truststore files contain the root, intermediate, and end user TLS certificates.
The keystores and truststores are in the correct directory.
Ensure that the keystore and truststore are in a directory that is accessible to the installer.
Secure connection to the Administrator tool
Before you secure the connection to the Administrator tool, verify that the following requirements are met:
You created a certificate signing request (CSR) and private key.
You can use keytool or OpenSSL to create the CSR and private key.
Note that RSA encryption requires more than 512 bits.
You have a signed TLS certificate.
The certificate can be self-signed or CA signed. Informatica recommends a CA signed certificate.
You imported the certificate into a keystore in JKS format.
A keystore can't contain more than one certificate. If you use a unique certificate for each web application service, create a separate keystore for each certificate. Alternatively, you can use a shared certificate and keystore.
ASK INFAPreview
