Configuring SSL: Two-Way Authentication

Two-way SSL authentication requires you to configure both server-side authentication and client-side authentication.

To set up this two-way authentication, you need to perform the following steps. You can perform these steps in one of the two ways - either using the keytool (to be run from your <JAVA_HOME>/bin directory) or by running the commands specified on the OpenSSL documentation website, http://wiki.openssl.org/index.php/Command_Line_Utilities.

Procedure

  1. Follow the steps outlined in Configuring SSL: One-Way Authentication.
  2. Generate the key store and private key for the HttpServer on the TIBCO Enterprise Administrator server and the HttpServer on the Agent.
  3. Generate a self-signed certificate or obtain a CA-signed certificate for the HttpServer on the TIBCO Enterprise Administrator server and the HttpServer on the Agent.
  4. Generate the key store and private key for the HttpClient on the TIBCO Enterprise Administrator server and the HttpClient on the Agent.
  5. Generate a self-signed certificate or obtain a CA-signed certificate for the HttpClient on the TIBCO Enterprise Administrator server and the HttpClient on the Agent.
  6. Import the Agent HttpServer’s certificate into the trust store used by TIBCO Enterprise Administrator server’s HttpClient.
  7. Import the TIBCO Enterprise Administrator server’s HttpServer’s certificate into the Agent’s HttpClients’ trust store.
  8. For the web browser (from where you will be accessing the TIBCO Enterprise Administrator UI): Generate a PKCS #12 format certificate which will include a private key for the browser and a public key and the browser’s certificate.
  9. Import the certificate from the above step into the web browser's trust store. Refer to the browser's documentation for details on importing the certificate into the browser.

Result

Once the SSL configuration has been set up and is working, the URL to access the TIBCO Enterprise Administrator server from the web UI will change from http://localhost:8777 to https://localhost:8777.
Related tasks