SSL
This section discusses the how the connector implements
an SSL capability. For background information, see your SSL documentation.
This section assumes a familiarity with SSL technology.
JSSE
The connector can expose collaborations as SOAP/HTTPS
web services and enable collaborations to invoke SOAP/HTTPS web
services. The connector uses JSSE to provide support for HTTPS and
SSL. IBM JSSE is shipped with the connector. To enable this capability,
make sure you have the following entry in the java.security file that is among the files installed with the connector:
security.provider.5=com.ibm.jsse.IBMJSSEProvider
Note that java.security is located in the $ProductDir\lib\security directory of your connector installation.
The connector uses the value of the JavaProtocolHandlerPackages
connector property to set the system property java.protocol.handler.pkgs.
Note that for the IBM JSSE that is shipped with the connector, the
value of this property should be set to com.ibm.net.ssl.internal.www.protocol. The JavaProtocolHandlerPackages configuration property defaults
to this value. However, if your system has a java.protocol.handler.pkgs
system property with a non-empty value, the connector would overwrite
it only if the JavaProtocolHandlerPackages connector property is also
set.
During initialization, the connector disables all anonymous cipher
suites supported by JSSE.
KeyStore and TrustStore
To use SSL with the connector, you must set up keystores
and truststores. No tool is provided to set up keystores, certificates,
and key generation. You must use third party software tools to complete
these tasks.
SSL Properties
You can specify the following SSL connector-specific properties:
- SSLVersion
- SSLDebug
- KeyStore
- KeyStoreAlias
- KeyStorePassword
- TrustStore
- TrustStorePassword
Note that these properties apply to a connector instance. The same
set of SSL property values are used by all of the SOAP/HTTPS protocol
listeners plugged into the connector and by the SOAP/HTTP-HTTPS
protocol handler for each connector instance. For further information
on HTTPS/SSL setup, see Appendix E. Configuring HTTPS/SSL.
Exposing collaborations as SOAP/HTTPS web services
When you expose collaborations as SOAP/HTTPS web services,
you use the SOAP/HTTPS protocol listener. To use the SOAP/HTTPS
protocol listener, you must specify SSL connector-specific properties.
The values you assign to these properties should reflect your SSL
requirements:
- SSLVersion Make sure that the SSLVersion
you want to use is supported by JSSE.
- KeyStore Because the SOAP/HTTPS protocol
listener acts as a server in SSL communications, you must specify
the keystore. The listener uses the keystore specified in the SSL " KeyStore
configuration property. The value of this property must be the complete
path to your keystore file. Make sure that the keystore has key
pair (private key and public key) for the connector. The alias of
the private key should be specified as the SSL " KeyStoreAlias
property. You must specify the password required to access the keystore
as the SSL " KeyStorePassword property. Also make sure
that the password required to access keystore and the private key
(in the keystore) are same. Finally, you must distribute the digital certificate
of the connector to your web service clients so that they can authenticate
the connector.
- TrustStore If you want the SOAP/HTTPS
protocol listener to authenticate web service clients, you must
activate client authentication. You do this by setting the SSL " UseClientAuth
property to true. You must also specify:
- the location of your truststore as the value of the SSL " TrustStore configuration
property
- the password required to access the truststore as the value
of the SSL " TrustStorePassword property
Make sure that your truststore contains the digital certificate
of your web service clients. Digital certificates used by your Web
Service clients may be self-signed or issued by CA. Note that if
your truststore trusts the root certificate of the CA, JSSE will
authenticate all the digital certificates issued by that CA.
For further information on HTTPS/SSL setup, see Appendix E. Configuring HTTPS/SSL.
Collaborations invoking SOAP/HTTPS web services
To enable collaborations to invoke SOAP/HTTPS web services,
you use the SOAP/HTTP-HTTPS protocol handler. If you are using SSL
with the SOAP/HTTP-HTTPS protocol handler, you must specify SSL
connector-specific properties. The values you assign to these properties
should reflect the HTTPS/SSL requirements of your web services provider:
- SSLVersion Make sure that the SSLVersion
you want to use is supported by your web service provider and by
JSSE.
- TrustStore Because the SOAP/HTTP-HTTPS
protocol handler acts as a client in SSL communications, you must
set up a truststore. The handler uses the truststore specified in
the SSL -> Truststore configuration property. The value
of this property must be the complete path to your truststore file.
You must specify the password required to access the truststore
in the SSL -> TrustStorePassword property. Make sure that
your truststore contains the digital certificate of your web service
provider. Digital certificates used by your web service provider
may be self-signed or they may be issued by CA. Note that if your
truststore trusts the root certificate of the CA, JSSE will authenticate
all the digital certificates issued by that CA.
- KeyStore If your web service provider
requires client authentication, you must set up a keystore. The
SOAP/HTTP-HTTPS protocol handler uses the keystore specified in
the SSL " KeyStore configuration property. This value must
be the complete path to your keystore file. Make sure that keystore
has a key pair (private key and public key) configured for the connector.
The alias of the private key must be specified in the SSL " KeyStoreAlias
property. The password required to access the keystore must be specified
in the SSL " KeyStorePassword property. Finally, make sure
that the password required to access the keystore and the private
key (in the keystore) are the same. You must distribute the connector's
digital certificate to your web service provider for authentication.
For further information on HTTPS/SSL setup, see Appendix E. Configuring HTTPS/SSL.
