Configuring SSL or TLS between the Connect:Direct bridge agent and the Connect:Direct node

Configure the Connect:Direct® bridge agent and the Connect:Direct node to connect to each other through the SSL protocol by creating a keystore and a truststore, and by setting properties in the Connect:Direct bridge agent properties file.

About this task

These steps include instructions for getting your keys signed by a certificate authority. If you do not use a certificate authority, you can generate a self-signed certificate. For more information about generating a self-signed certificate, see Working with SSL/TLS on AIX, Linux, and Windows.

These steps include instructions for creating a new keystore and truststore for the Connect:Direct bridge agent. If the Connect:Direct bridge agent already has a keystore and truststore that it uses to connect securely to IBM MQ queue managers, you can use the existing keystore and truststore when connecting securely to the Connect:Direct node. For more information, see Configuring SSL or TLS encryption for MFT.

Procedure

For the Connect:Direct node, complete the following steps:

Generate a key and signed certificate for the Connect:Direct node.
You can do this by using the IBM Key Management tool that is provided with IBM MQ. For more information, see Working with SSL/TLS.
Send a request to a certificate authority to have the key signed. You receive a certificate in return.
Create a text file; for example, /test/ssl/certs/CAcert, that contains the public key of your certification authority.
Install the Secure+ Option on the Connect:Direct node.
If the node already exists, you can install the Secure+ Option by running the installer again, specifying the location of the existing installation, and choosing to install only the Secure+ Option.
Create a new text file; for example, /test/ssl/cd/keyCertFile/node_name.txt.

Copy the certificate that you received from your certification authority and the private key, located in /test/ssl/cd/privateKeys/node_name.key, into the text file.

The contents of /test/ssl/cd/keyCertFile/node_name.txt must be in the following format:

Start the Secure+ Admin Tool.
- On AIX and Linux systems, run the command spadmin.sh.
- On Windows systems, click Start > Programs > Sterling Commerce Connect:Direct > CD Secure+ Admin Tool
The CD Secure+ Admin Tool starts.
In the CD Secure+ Admin Tool, double-click the .Local line to edit the main SSL or TLS settings.
1. Select Enable SSL Protocol or Enable TLS Protocol, depending on which protocol you are using.
2. Select Disable Override.
3. Select at least one Cipher Suite.
4. If you want two-way authentication, change the value of Enable Client Authentication to Yes.
5. In the Trusted Root Certificate field, enter the path to the public certificate file of your certification authority, /test/ssl/certs/CAcert.
6. In the Key Certificate File field, enter the path to the file that you created, /test/ssl/cd/keyCertFile/node_name.txt.
Double-click the .Client line to edit the main SSL or TLS settings.
1. Select Enable SSL Protocol or Enable TLS Protocol, depending on which protocol you are using.
2. Select Disable Override.

For the Connect:Direct bridge agent, perform the following steps:

Create a truststore. You can do this by creating a dummy key and then deleting the dummy key.

You can use the following commands:


keytool -genkey -alias dummy -keystore /test/ssl/fte/stores/truststore.jks


keytool -delete -alias dummy -keystore /test/ssl/fte/stores/truststore.jks

Import the public certificate of the certification authority into the truststore.

You can use the following command:


keytool -import -trustcacerts -alias myCA 
        -file /test/ssl/certs/CAcert 
        -keystore /test/ssl/fte/stores/truststore.jks

Edit the Connect:Direct bridge agent properties file.
Include the following lines anywhere in the file:
```
cdNodeProtocol=protocol
cdNodeTruststore=/test/ssl/fte/stores/truststore.jks
cdNodeTruststorePassword=password
```
In the example in this step, protocol is the protocol you are using, either SSL or TLS, and password is the password that you specified when you created the truststore.
If you want two-way authentication, create a key and certificate for the Connect:Direct bridge agent.
1. Create a keystore and key.
  You can use the following command:
```
keytool -genkey -keyalg RSA -alias agent_name 
        -keystore /test/ssl/fte/stores/keystore.jks 
        -storepass password -validity 365
```
2. Generate a signing request.
  You can use the following command:
```
keytool -certreq -v -alias agent_name 
        -keystore /test/ssl/fte/stores/keystore.jks -storepass password 
        -file /test/ssl/fte/requests/agent_name.request
```
3. Import the certificate you receive from the preceding step into the keystore. The certificate must be in x.509 format.
  You can use the following command:
```
keytool -import -keystore /test/ssl/fte/stores/keystore.jks 
        -storepass password -file certificate_file_path
```
4. Edit the Connect:Direct bridge agent properties file.
  Include the following lines anywhere in the file:
```
cdNodeKeystore=/test/ssl/fte/stores/keystore.jks
cdNodeKeystorePassword=password
```
  In the example in this step, password is the password that you specified when you created the keystore.