Configuring database security

If the database server is configured for SSL/TLS encryption, configure IBM Controller Disclosure Management to use an encrypted connection by importing the database SSL certificate into the server trust store and setting the required environment variables.

Before you begin

Before you begin, ensure that:

  • The database server is configured for SSL/TLS encryption.
  • You have the SSL certificate used by the database server, or you can obtain it from your database administrator.
  • You have administrator access to the IBM Controller Disclosure Management Server.
  • IBM Controller is communicating with the database over an encrypted connection. The same SSL certificate used by IBM Controller for database communication must be imported into the IBM Controller Disclosure Management trust store.

About this task

When the database server requires SSL/TLS encryption, IBM Controller Disclosure Management must be configured to trust the database server certificate. This is done by importing the certificate into the IBM Controller Disclosure Management trust store and then setting the database SSL properties in the server.env environment file.

Procedure

  1. Import the database server SSL certificate into the IBM Controller Disclosure Management trust store at the following location: 
    <install-path>/wlp/usr/servers/ibmdm/resources/security/trust.p12
    Note: Use the same certificate import steps that were followed when configuring SSL for IBM Controller's database connection.
  2. Open the server environment file at: 
    <install-dir>/wlp/usr/servers/ibmdm/server.env
  3. Add or update the following database SSL properties in server.env: 
    DB_TRUST_SERVER_CERTIFICATE=false
DB_TLS_MODE=STRICT
DB_ENCRYPT=true
DB_TRUSTSTORE_PASSWORD=<trust-store-password>
DB_TRUSTSTORE_PATH=<install-dir>/wlp/usr/servers/ibmdm/resources/security/trust.p12
    Table 1. Database SSL properties
    Property Description
    DB_TRUST_SERVER_CERTIFICATE Set to false to require validation of the database server certificate during the TLS handshake. When set to false, the server certificate must be present in the trust store.
    DB_TLS_MODE Set to STRICT to enforce a fully validated TLS connection to the database. The connection fails if the certificate cannot be validated.
    DB_ENCRYPT Set to true to enable TLS encryption for all communication between IBM Controller Disclosure Management and the database.
    DB_TRUSTSTORE_PASSWORD The password for the trust store file. The default password is changeit. Replace with the actual password if the trust store has been secured with a custom password.
    DB_TRUSTSTORE_PATH The absolute file system path to the trust store file that contains the imported database server SSL certificate.
    Important: The DB_TRUSTSTORE_PASSWORD value must be encrypted using the Secret Manager. Do not store plain-text passwords in server.env.
  4. Save server.env.
  5. Run the secrets initialization script from the following directory to encrypt the updated properties: 
    <install-dir>/wlp/etc/init-secrets.ps1
    Note: Run this script from an administrator PowerShell window.
  6. Restart the IBM Controller Disclosure Management service to apply the updated database SSL configuration.

Results

IBM Controller Disclosure Management is configured to connect to the database over an encrypted SSL/TLS connection. All database communication is encrypted and the server certificate is validated against the trust store on each connection.

What to do next

After completing the configuration, verify the database connection by reviewing the application log at:

<install-dir>/wlp/usr/servers/ibmdm/logs/application.log

Confirm that no SSL handshake or certificate validation errors are present at startup.