Understanding SSL/TLS

With business-to-business applications, where systems communicate with each other over the internet, data must flow securely. As such, system-to-system authentication is critical. PeopleSoft uses HTTPS and digital certificates for secure transmission of data between systems and system-to-system authentication. PeopleTools use the inherently supported SSL/TLS implementation provided with JRE.^TM

The PeopleSoft system uses Extensible Markup Language (XML) messaging over HTTPS for our Integration Broker and Business Interlink technologies to deliver system-to-system integration over the internet. HTTPS is used to guarantee secure transmission of the XML message. The digital signature of the XML message is used for authentication between systems. With digital certificates, XML messages are digitally signed to prove that the message came from the server that created and signed the message and to prove that the message has not been altered.

The following table lists the PeopleSoft technologies that use HTTPS (HTTP over SSL/TLS) and how it is implemented for each technology.

Technology	How HTTPS (HTTP over SSL/TLS) is Implemented
PeopleSoft Portal Solutions	Secure page transport — Uses web server platform to provide server side SSL/TLS. Secure access to remote content providers — Application server uses JRE to provide the client side of SSL/TLS connection to gateway. Uses web server platform to provide server side SSL/TLS.
PeopleSoft Integration Broker (application messaging)	Secure message transport to remote nodes — Application server uses JRE to provide client side of SSL/TLS connection to gateway. Uses web server platform to provide server side SSL/TLS.
PeopleSoft Business Interlinks	Secure calls to remote data sources or modules — Application server uses JRE to provide client side of SSL/TLS connection to gateway. Uses web server platform to provide server side SSL/TLS.
User Authentication	Certificate-based client authentication — Uses web server SSL/TLS client authentication. Certificate data is passed to application server. The application server trusts the web server's authentication. Distinguished name of the certificate is used to log on to PeopleSoft system.