Certificate management

Remote Control uses certificates in the Server and in the Broker to address the authentication and verification required for ensuring secure connections between the different product components.

Remote Control can use multiple types of Public Key Infrastructure ( PKI)

  • A commercial Certificate Authority ( CA)
  • An internal CA
  • Self-signed certificates
There is no difference between using a commercial CA or an internal CA and it is possible to mix the two kinds. For example, you can run the Remote Control server with a self-signed certificate while running all brokers with CA-signed certificates.

Remote Control provides two levels of certificate validation, strict certificate validation and non-strict certification validation.
Non-strict certificate validation
  • Non-strict certificate validation performs the following checks against the certificate
    • The identity of the certificate matches the hostname of the broker that you are trying to connect to.
    • The certificate is within its validity period.
    In non-strict mode, the client does not need a trust store to perform the validation.
    Note: This type of certificate validation is strongly discouraged for production usage for remote control sessions over the internet, it is only intended for demo and test environments.
Strict certificate validation
  • Strict certificate validation performs one additional check. This additional check requires that the client has a trust store that contains all the root certificates required to validate the certificate chain.

For Certificate operations you can use the IBM Key Management tool (ikeyman), which ships as part of Remote Control, the OpenSSL command line tool or other third party tools. Procedures in this manual show the use of the IBM Key Management tool.