This section discusses the how the connector implements an SSL
capability. For background information, see your SSL documentation.
This section assumes a familiarity with SSL technology.
The connector can expose collaborations as SOAP/HTTPS web
services and enable collaborations to invoke SOAP/HTTPS web
services. The connector uses JSSE to provide support for HTTPS and
SSL. IBM JSSE is shipped with the connector. To enable this
capability, make sure you have the following entry in the
java.security file that is among the files installed with
the connector:
security.provider.5=com.ibm.jsse.IBMJSSEProvider
Note that java.security is located in the
$ProductDir\lib\security directory of your connector
installation. The connector uses the value of the
JavaProtocolHandlerPackages connector property to set the system
property java.protocol.handler.pkgs. Note that for the IBM JSSE
that is shipped with the connector, the value of this property
should be set to
com.ibm.net.ssl.internal.www.protocol.
The JavaProtocolHandlerPackages configuration property defaults
to this value.
During initialization, the connector disables all anonymous
cipher suites supported by JSSE.
To use SSL with the connector, you must set up keystores and
truststores. No tool is provided to set up keystores, certificates,
and key generation. You must use third party software tools to
complete these tasks.
You can specify the following SSL connector-specific
properties:
- SSLVersion
- SSLDebug
- KeyStore
- KeyStoreAlias
- KeyStorePassword
- TrustStore
- TrustStorePassword
Note that these properties apply to a connector instance. The
same set of SSL property values are used by all of the SOAP/HTTPS
protocol listeners plugged into the connector and by the
SOAP/HTTP-HTTPS protocol handler for each connector instance. For
further information on HTTPS/SSL setup, see Appendix E, Configuring
HTTPS/SSL.
When you expose collaborations as SOAP/HTTPS web services, you
use the SOAP/HTTPS protocol listener. To use the SOAP/HTTPS
protocol listener, you must specify SSL connector-specific
properties. The values you assign to these properties should
reflect your SSL requirements:
- SSLVersion Make sure that the SSLVersion you want to use
is supported by JSSE.
- KeyStore Because the SOAP/HTTPS protocol listener acts
as a server in SSL communications, you must specify the keystore.
The listener uses the keystore specified in the SSL " KeyStore
configuration property. The value of this property must be the
complete path to your keystore file. Make sure that the keystore
has key pair (private key and public key) for the connector. The
alias of the private key should be specified as the SSL "
KeyStoreAlias property. You must specify the password required to
access the keystore as the SSL " KeyStorePassword property. Also
make sure that the password required to access keystore and the
private key (in the keystore) are same. Finally, you must
distribute the digital certificate of the connector to your web
service clients so that they can authenticate the connector.
- TrustStore If you want the SOAP/HTTPS protocol listener
to authenticate web service clients, you must activate client
authentication. You do this by setting the SSL " UseClientAuth
property to true. You must also specify:
- the location of your truststore as the value of the SSL "
TrustStore configuration property
- the password required to access the truststore as the value of
the SSL " TrustStorePassword property
Make sure that your truststore contains the digital certificate
of your web service clients. Digital certificates used by your Web
Service clients may be self-signed or issued by CA. Note that if
your truststore trusts the root certificate of the CA, JSSE will
authenticate all the digital certificates issued by that CA.
For further information on HTTPS/SSL setup, see Appendix E, Configuring
HTTPS/SSL.
To enable collaborations to invoke SOAP/HTTPS web services, you
use the SOAP/HTTP-HTTPS protocol handler. If you are using SSL with
the SOAP/HTTP-HTTPS protocol handler, you must specify SSL
connector-specific properties. The values you assign to these
properties should reflect the HTTPS/SSL requirements of your web
services provider:
- SSLVersion Make sure that the SSLVersion you want to use
is supported by your web service provider and by JSSE.
- TrustStore Because the SOAP/HTTP-HTTPS protocol handler
acts as a client in SSL communications, you must set up a
truststore. The handler uses the truststore specified in the SSL
-> Truststore configuration property. The value of this property
must be the complete path to your truststore file. You must specify
the password required to access the truststore in the SSL ->
TrustStorePassword property. Make sure that your truststore
contains the digital certificate of your web service provider.
Digital certificates used by your web service provider may be
self-signed or they may be issued by CA. Note that if your
truststore trusts the root certificate of the CA, JSSE will
authenticate all the digital certificates issued by that CA.
- KeyStore If your web service provider requires client
authentication, you must set up a keystore. The SOAP/HTTP-HTTPS
protocol handler uses the keystore specified in the SSL " KeyStore
configuration property. This value must be the complete path to
your keystore file. Make sure that keystore has a key pair (private
key and public key) configured for the connector. The alias of the
private key must be specified in the SSL " KeyStoreAlias property.
The password required to access the keystore must be specified in
the SSL " KeyStorePassword property. Finally, make sure that the
password required to access the keystore and the private key (in
the keystore) are the same. You must distribute the connector's
digital certificate to your web service provider for
authentication.
For further information on HTTPS/SSL setup, see Appendix E, Configuring
HTTPS/SSL.
