Running Business Processes and Composite Applications 10.5 | Running Business Processes and Composite Applications | Universal Messaging Administration Guide | Universal Messaging Enterprise Manager | Administering TCP Interfaces, IP Multicast, and Shared Memory | Creating an SSL-Enabled Interface
 
Creating an SSL-Enabled Interface
To add an SSL-enabled interface using the Enterprise Manager, first create an nsps or nhps interface as described in Creating Interfaces.
The following image shows an nhps (HTTPS) interface listening on port 9443.
Click the Certificates tab. You can see that the values for the Key store path and Trust store path fields are automatically specified. In the Universal Messaging download, we provide a utility called Certificate Generator that can generate sample .jks files containing certificates bound to localhost, for the server, the client, and the truststore used by JSSE. In this example, we use the sample jks files to demonstrate how to create an SSL interface. For detailed information about generating certificates, see How to Generate Certificates for Use.
The Key store path field should contain something similar to:
c:\SoftwareAG_directory\UniversalMessaging\server\umserver\bin\server.jks
which should be the path to the sample Java keystore for the server, bound to localhost.
The Trust store path field should contain something similar to the following:
c:\SoftwareAG_directory\UniversalMessaging\server\umserver\bin\nirvanacacerts.jks
Then specify the value password for Key Store Passwd and CA Store Passwd. This is the password for both the server keystore and the CA (truststore) keystore.
Next, go to the Basic tab and select the Autostart Interface option to start the interface automatically when the Universal Messaging realm server starts.
Note: If you intend to use an SSL interface for inter-realm communication, you should ensure that the Allow for InterRealm option is selected and the Allow Client Connections option is cleared. Alternatively, if you intend to use an SSL interface for communication between clients and the realm, you should ensure that the Allow for InterRealm option is cleared and the Allow Client Connections option is selected. For information about inter-realm communication, see Setting Up Inter-Realm Communication.
Click Apply to save your changes and start the interface. If the network interface fails to start, inspect the Universal Messaging log file.
There is no limit to the number of network interfaces that can be added to a realm and each can have its own configuration, such as SSL chains, applied. This enables you to isolate customers from each other while still using only one Universal Messaging realm server.
In this example we have used our own sample Java keystores, which will only work when using the loopback interface of your realm server host. If you want to provide SSL capabilities for remote connections, you must ensure you have your own keystores and valid certificate chains.
Client Certificate Validation
If you select Enable Client Cert Validation on the Interfaces > Certificates tab, clients that connect to the interface must supply their client certificate. This will be a file with a name like client.jks, which can be created in a way similar to the server.jks and nirvanacacerts.jks files mentioned above.
If you want to connect to such an interface using the Enterprise Manager, you must specify the name of the client certificate file in the configuration file UniversalMessaging\java\umserver\bin\nenterprisemgr.conf, in the line that defines the -DCKEYSTORE parameter, for example:
wrapper.java.additional.7="-DCKEYSTORE=%CKEYSTORE%"
If you do not require client certificate validation for this interface, clear the Enable Client Cert Validation option. In this case, the -DCKEYSTORE parameter is still required, but its value must be set to null:
wrapper.java.additional.7="-DCKEYSTORE="

Copyright © 2019 | Software AG, Darmstadt, Germany and/or Software AG USA, Inc., Reston, VA, USA, and/or its subsidiaries and/or its affiliates and/or their licensors.