Securing integration services by using SSL

If you want to use the integration node listener for HTTPS, configure values for the node's HTTP listener properties.

1. Optional: If you do not want to use the default port 7083 for HTTPS messages, specify the port on which the integration node listens:

   mqsichangeproperties integrationNodeName
     -b httplistener -o HTTPSConnector
     -n port -v Port_to_listen_on_for_https

   On UNIX systems, only processes that run under a privileged user account (in most cases, root) can bind to ports lower than 1024.

   For the integration node to listen on these ports, the user ID under which the integration node is started must be root.
2. Optional: Enable Client Authentication (mutual authentication):

   mqsichangeproperties integrationNodeName -b httplistener -o HTTPSConnector
     -n ReqClientAuth -v true 

3. Restart the integration node after changing one or more of the HTTP listener properties.
4. Optional: Use the following commands to display HTTP listener properties:

   mqsireportproperties integrationNodeName -b httplistener -o AllReportableEntityNames -a 
   mqsireportproperties integrationNodeName -b httplistener -o HTTPListener -a 
   mqsireportproperties integrationNodeName -b httplistener -o HTTPSConnector  -a 

If you want to use the integration server listener for HTTPS, configure values for the server's HTTP listener properties.

1. Optional: Specify a specific port on which the integration server listens for HTTPS requests, or leave the value unset to use the next available port number.

   mqsichangeproperties integrationNodeName
     -e integration_server_name -o HTTPSConnector
     -n explicitlySetPortNumber -v port_number

   On UNIX systems, only processes that run under a privileged user account (in most cases, root) can bind to ports lower than 1024. For the integration server to listen on these ports, the user ID under which the integration node is started must be root.

   If you do not complete this step, the first available port in the default range (7843 - 7884) is used.

2. Optional: Enable Client Authentication (mutual authentication):

   mqsichangeproperties integrationNodeName
     -e integration_server_name -o HTTPSConnector
     -n ReqClientAuth -v true 

3. Optional: Change the SSL protocol.
   The default protocol for the HTTPInput node is TLS. Run the following command to change it to SSL. The only supported versions of TLSProtocols are TLSv1.2 and TLSv1.3. The values are not case-sensitive. If TLSProtocols is set to all, both versions are enabled. For more information, see Integration server HTTP listener parameters (SOAP and HTTP nodes). :

   mqsichangeproperties integrationNodeName
     -e integration_server_name -o HTTPSConnector
     -n TLSProtocols -v TLSv1.2

4. Restart the integration node after changing one or more of the listener properties.
5. Optional: Use the following command to display HTTPS properties:

   mqsireportproperties integrationNodeName 
     -e integration_server_name -o HTTPSConnector  -r 

1. In the IBM App Connect Enterprise Toolkit, open your integration service in the integration service editor by double-clicking Integration Service Description in the Application Development view.
2. Click the Service tab.
   The integration service description is displayed, which includes the integration service bindings.
3. If you are using the SOAP/HTTP binding, then click SOAP/HTTP Binding and select Use HTTPS from the HTTP Transport properties panel.
4. If you are using the JavaScript client API, then click JavaScript client API and then select Use HTTPS from the Basic properties panel.
   Note: If you are using a web browser-based JavaScript application to call the integration service, then you must select Use HTTPS on both the SOAP/HTTP binding and the JavaScript client API. The HTTP proxy servlet routes requests only to endpoints that use the same protocol as the web browser. The HTTP proxy servlet routes requests to both the SOAP and JavaScript client API endpoints, and so both endpoints must match the web browser protocol.
5. Save and redeploy the integration service.