InformixHQ Agent setup for secured connection (SSL)

About this task

This topic explains steps for setting up InformixHQ Agent for secured socket connection (SSL).

Procedure

  1. Create client keystore for HQ Agent connection:
    • Extract self-signed certificate from HQ server keystore using following command: 
      keytool -export -alias selfsigned -file server.cer -keystore keystore.jks
      • Same alias should be used as that of server keystore.
      • Keystore name would be server keystore.
      • This command will extract certificate to file server.cer (value provided for -file argument)
    • Copy this certificate to client machine (where HQAgent would be running).
    • Import this certificate to client keystore on HQAgent box using following command: 
      keytool -import -v -trustcacerts -alias selfsigned -file server.cer -keystore cacerts.jks
      • Ensure alias is same as used in server keystore.
      • This will ask to set keystore password, enter the password of your choice.
      • Note the password as this will be needed at a later stage.
  2. Note down client SSL keystore path, filename just created.
  3. Modify informixhq-agent.properties to add/modify following properties:
    • informixServer.id=<ID of the Informix Server defined in InformixHQ>
    • server.host=<InformixHQ server host>
    • server.port=<InformixHQ server port> (for above example, it would be 8082)
    • ssl.enable=true
    • ssl.keystore.file=<client keystore absolute path and file name>
    • ssl.keystore.password=<password>
    • ssl.keystore.type=jks
  4. Start InformixHQ agent as usual.
    Note:

    1) In case, InformixHQ server and agent are running on the same machine, Server keystore can also be used as client keystore for Agent. This means same Keystore path and password will be used in both informixhq-server.properties and informixhq-agent.properties files.

    2) In case InformixHQ server and agent are running on different machines, users can also copy server keystore to agent machine and use the same keystore, instead of extracting certificate and creating new client keystore.

    3) If any changes are done to keystore or properties file while HQ server or agent is running, ensure to restart InfomrixHQ server or Agent appropriately.

    4) On windows machine, add double slash for keystore path such as D:\\SSL\\keystore\\key.jks