Keystore configuration

An integration server can use a keystore for encrypting and decrypting data. The keystore must be a password-protected keystore in a JKS, PKCS12, or RDB format.

In an IBM® App Connect Enterprise on-premises system, the keystore is a file that the integration server references, and it is set either by the mqsichangeproperties command or by using configuration in the server.conf.yaml file.

To use the keystore in an integration server in a containerized environment, you need to use a Keystore configuration type. The keystore file in the Keystore configuration type will be placed unchanged in the directory /home/aceuser/keystores in the integration server containers, with the same name as its configuration object name. For example, if you called the configuration my-keystore.jks, the keystore will be copied to /home/aceuser/keystores/keystore.jks. This path can then be referenced from the server.conf.yaml file that is also provided as a configuration object, or from other configuration files like odbc.ini.

For IBM MQ key repositories, several files are required for a key repository: an RDB, a KDB, and an STH file. Create these files as separate keystore configurations with the same name but different extensions, and apply each of them to the integration server. For example, create my-mqcerts.kdb, my-mqcerts.rdb, and my-mqcerts.slt, and then reference these files from the server.conf.yaml file by using /home/aceuser/keystores/my-mqcerts.

The password is not set on this configuration object, so instead use the setdbparms.txt configuration type to define security identities that contain the password, and then use those identities to supply the password to configuration files like server.conf.yaml.

The name of the configuration object is used as the file name of the keystore inside the integration server, so you must provide a name that is suffixed with a supported file extension; for example, name.jks. If a file extension is not included as part of the configuration name, the integration server will not recognize this configuration, and error messages will be generated during the deployment.

  • If you are creating the configuration object by using the Red Hat® OpenShift® web console or CLI, you will need to run a Base64 encoder against your keystore file and use the output as the value of the parameter in the configuration custom resource. For more information, see Creating a configuration object.
  • If you are using the App Connect Dashboard, you can create the configuration object from the Configuration page or while creating the integration server, as described in Configuration types for integration servers.

For more information about this configuration type, see Keystore type.