Configuring Secure Sockets Layer

By default, communications between the Repository and the LDAP server are unencrypted. You can configure the LDAP server and Worklist Manager to use Secure Sockets Layer (SSL).

To encrypt communications between the Repository and the LDAP server

1. Configure SSL on the LDAP server.

   Ensure that the LDAP server is configured to use the Secure Sockets Layer (SSL). For detailed instructions, see the documentation provided with the LDAP server.

2. Export the LDAP server certificate to a file.

3. Import the LDAP server certificate to the Repository’s list of trusted certificates. The following steps use the keytool program. This program is included with the Repository (as well as the Java SDK).

4. From a command prompt, navigate to <JavaCAPS_home>\repository\1.5.0_10\jre\bin.

5. Run the following command:

   keytool -import -trustcacerts -alias alias -file certificate_filename -keystore cacerts_filename

   For the -alias option, assign any value.

   For the -file option, specify the fully qualified name of the LDAP server certificate. For example:

   C:\ldap\mycertificate.cer

   For the -keystore option, specify the fully qualified name of the cacerts file, located in <Java CAPS_home>\repository\1.5.0_10\jre\lib\security. For example:

   C:\JavaCAPS51\repository\1.5.0_10\jre\lib\security\cacerts

6. When prompted, enter the keystore password. The default password is changeit.

7. When prompted whether to trust this certificate, enter yes.

   The following message appears:

   Certificate was added to keystore

8. In the Realm element of the server.xml file, modify the URL of the LDAP server as follows:

   1. Set the protocol to ldaps.

   2. Set the port number to the port number that the LDAP server listens on for SSL requests. Typically, this number is 636.

      For example:

      <Realm className="org.apache.catalina.realm.JNDIRealm" connectionURL="ldaps://myldapserver:636">