Server security

IBM Controller Disclosure Management Server is configured by default with both HTTP and HTTPS listeners. For production environments, use HTTPS with a certificate issued by a trusted certificate authority.

Default port configuration

The default installation configures two listeners on IBM Controller Disclosure Management Server:

Table 1. Default server listeners
Protocol Default port Description
HTTPS (SSL) 10443 Secure listener. Recommended for all production deployments.
HTTP 8080 Unsecured listener. Do not expose this port in production environments.
Important: Do not expose the HTTP listener on port 8080 in a production environment. Use the HTTPS listener on port 10443 to ensure that all data and credentials are encrypted in transit.

Configuring ports in server.xml

Port assignments are controlled by the server configuration file located at:

<install-dir>/wlp/usr/servers/ibmdm/server.xml

Edit server.xml to change the default port values or to disable the HTTP listener for production use.

Note: Changes to server.xml require a restart of the IBM Controller Disclosure Management service to take effect.

Configuring an SSL certificate

IBM Controller Disclosure Management Server supports the use of a certificate issued by a trusted certificate authority (CA) or a self-signed certificate for the HTTPS listener.

The certificate must be in PKCS12 (.p12) format before it can be used by the server. If your certificate is in a different format, convert it to PKCS12 before proceeding.

To use a CA-issued or self-signed certificate:

  1. Obtain the certificate from your certificate authority or generate a self-signed certificate.
  2. Convert the certificate to PKCS12 (.p12) format if it is not already in that format.
  3. Place the .p12 file in a secure location on the IBM Controller Disclosure Management Server.
  4. Update the SSL keystore settings in server.xml to reference the new certificate file, specifying the keystore path, type, and password.
  5. Restart the IBM Controller Disclosure Management service to apply the new certificate.