Setting Gateway Digital Certificate Security Properties
You can implement gateway-based digital encryption on the integration gateway. When implemented you must set the integration gateway digital certificate alias, certificate alias password, keystore path, and keystore password in the integration gateway properties file.
At a minimum you must specify the path and password to the integration gateway keystore in the integration gateway properties file. Although highly recommended, you do not need to install digital certificates to meet this requirement. You need only specify the path and password to the keystore.
Use the PSKeyManager utility delivered with PeopleTools to generate the keystore password. See “Understanding PSKeyManager Utility” in Security Administration: Installing Web Server-Based Digital Certificates for information on using the PSKeyManager utility.
Most production environments have SSL/TLS implemented. If the integration gateway is installed on a web server that has SSL/TLS implemented, you can specify the SSL/TLS keystore path and password to meet this requirement.
Important:
SSL/TLS encryption applies digital certificates from two keystores to encrypt inbound and outbound messages, respectively. The integration gateway manages the certificates in the keystore that supports outbound messaging. So if you specify the SSL/TLS keystore path and password, be sure to use the proper values.
Use the section labeled Integration Gateway CERTIFICATE Section in the integration gateway properties file to define the keystore path and encrypt the keystore password.
WARNING:
Integrations will fail if you do not set the path to the keystore using the secureFileKeystorePath property and enter an encrypted keystore password for the secureFileKeystorePasswd property.You must set the following properties in integrationGateway.properties so that the gateway can access the encryption certificates.
| Property | Description |
|---|---|
|
ig.certificateAlias |
(Optional.) If implementing gateway-based digital certificates, enter the name that you provided to identify the encryption key pair that you generated for the keystore on which the gateway's public key certificate is based. |
|
ig.certificatePasswd |
(Optional.) If implementing gateway-based digital certificates, enter the password that you provided for the encryption key pair that you generated for the keystore. The certificate password must be encrypted. See Encrypting Passwords. |
|
ig.TurnOffFailover |
If a Jolt connection\transaction to a node (application server) fails, Jolt will try to send the request again using the next application server defined in the serverURL string. To turn Jolt retry off (and send the error back to the client) set the property to TRUE. Note: When multiple application server entries are defined on the serverURL string, round robin will not be affected if this property is enabled. |
|
ig.TurnOffOAuth2 |
(Optional) If implementing an authorization server that is currently not supported by the Integration Broker framework, set the value of this property to True in order to turn off OAuth2 processing by the Integration Broker framework. This option is delivered as False by default. See Disabling OAuth2 Authentication for REST Integrations. You can also use this property to disable OAuth2 processing for a specific integration at the service operation level. See Disabling OAuth2 Authentication for REST Service Operations. |
|
secureFileKeystorePath |
Enter the full path and file name of the gateway keystore file, which is located in the web server directory structure. The path is <PIA_HOME>\webserv\<DOMAIN>\piaconfig\keystore. |
|
secureFileKeystorePasswd |
Enter the keystore password. . This password must be encrypted. See Encrypting Passwords. |