Configuring TLS encryption properties for Access Server

To enable TLS encryption for connections to and from Access Server, you configure the tls.properties file.

Before you begin

You must create a private key store as described in Creating a private keystore and a trust store for encryption. You might also need to create a trust store.

Procedure

Locate the TLS encryption properties file.
For Access Server, the tls.properties file is located in the user data folder.

For example:

Windows

drive:\Users\user_name\AppData\Local\IBM\InfoSphere Data Replication\Access Server\11.4\tls.properties

Linux

/opt/IBM/InfoSphereDataReplication/AccessServer/tls.properties
Uncomment and update the properties that are required for your TLS encryption configuration:
```
#################################################
# This first section is for configuring both Access Server and clients.  

# Backslashes must be escaped with an extra backslash.
#trustStorePath=C:\\path\\to\\trust.jks
#trustStorePath=/path/to/trust.jks
#trustStorePassword=password
#trustStoreType=JKS

#################################################
# This second section is for configuring Access Server, included embedded Access Server.

# Backslashes must be escaped with an extra backslash.
#privateKeyStorePath=C:\\path\\to\\privatekey.jks
#privateKeyStorePath=/path/to/privatekey.jks
#privateKeyStorePassword=password
#privateKeyStoreType=JKS

#enableTLS=true
#datastoresAlwaysTLS=false
```
Where:
- trustStorePath - The path to the trust store that contains trusted root certificates. Backslashes must be escaped with an extra backslash.
- trustStorePassword - The password that is required to unlock the trust store
- trustStoreType - The type of trust store: JKS or PKCS12
- privateKeyStorePath - The path to the private key store that contains the private key and public certificate chain. Backslashes must be escaped with an extra backslash.
- privateKeyStorePassword - The password that is required to unlock the private key store
- privateKeyStoreType - The type of trust store: JKS or PKCS12
- enableTLS - Whether to enable TLS (true or false)
- datastoresAlwaysTLS - Specify false to support datastores that negotiate encryption with STARTTLS. Specify true to support datastores that always use TLS.