Informatica domain Certificate Installation process

Informatica requires SSL certificate from 10.2 to enables secure communication between client and server machines.

1. Download the certificate in pfx (PKCS12) format from your organisation portal if trust chain is issued by org or create trust chain.

Import the certificate 

keytool -importkeystore -srcstoretype JKS -srckeystore privatecertificate.pfx 

-deststoretype PKCS12 -destkeystore infa_keystore.pkcs12

2. convert pfx to pem format

openssl pkcs12-in infa_keystore.pkcs12 -nodes -out infa_keystore.pem

3. convert pkcs12 to jks

keytool -importkeystore -srcstoretype PKCS12 -srckeystore infa_keystore.pkcs12

-deststoretype PKCS12 -destkeystore infa_keystore.jks

4. Import the root certificate into infa_truststore.jks. Below command will create theinfa_truststore.jks. file with root inside it . Trust the certififcate with yes when it is prompted.

keytool -import -alias root -keystore infa_truststore.jks -trustcerts -file "Root.crt"

5. Import the intermediate certificate into infa_truststore.jks. Below command will create theinfa_truststore.jks. file with root inside it . Trust the certififcate with yes when it is prompted.

keytool -import -alias root -keystore infa_truststore.jks -trustcerts -file "Intermediate.crt"

6.Import the public certificate into infa_truststore.jks. Below command will create theinfa_truststore.jks. file with root inside it . Trust the certififcate with yes when it is prompted.

keytool -import -alias root -keystore infa_truststore.jks -trustcerts -file "Cert.crt"

7. convert jks into pkcs12 format

keytool -importkeystore -srcstoretype JKS -srckeystore infa_truststore.jks

-deststoretype PKCS12 -destkeystore infa_truststore.pkcs12

7. convert pkcs12 into pem format

openssl pkcs12 -in infa_truststore.pkcs12 -nodes -out infa_truststore.pem

We have keystore and trust store in jks and pem format. We can use these trust chain for admin console and SSL connections.

to avoid confusion for domain and admin cosole keystore. We will copy the infa keystore to default keystore.

8. Copy infa keystore to default keystore.

cp infa_truststore.jks default.keystore

9. Copy these certificates into informatica default path which is below path.

cp   infa_*  $INFA_HOME/services/shared/

10. Go to ISP config and nodemeta.xml

cd $INFA_HOME/isp/config

cat nodemeta.xml | grep https

11. Shutdown the domain. Verify that no process running before proceed further step

./stopinfa.sh stop  

12. Get the https port and setup the node with the https port using infa setup command.

cd $INFA_HOME/isp/bin

./infasetup.sh updategatewaynode -dn Domain_ISP -hs httpsportnumber -kf keystorefile -kp keystorepassword -nk pathofthekeystore -nkp truststorefilepassword -nt truststore -ntp trusstorepassword

then run the default path also

./infasetup.sh updategatewaynode -hs httpsportnumber -kf defaultkeystorefile  -kp password

13. start the services

./startinfa.sh start

14. To check whether services are running fine

cd $INFA_HOME/logs/node

tail -50f catalina.out

15. Check all init methods called successfully  from cataline.out file.

Verify admin console running fine by using the file node.log

tail -50f node.log

16. Copy these truststore files into client machine and place in Informatica installed directory/shared and connect from client machine..