Open topic with navigation

TIBCO® Enterprise Administrator 2.4.2

# SSL Properties

When configuring SSL on the TIBCO Enterprise Administrator, you must set some properties on both the TIBCO Enterprise Administrator server as well as the agent.

Note: Setting the HttpClient properties on both the agent and the TIBCO Enterprise Administrator server is mandatory only if you want to set up a two-way SSL configuration. Do not set the HttpClient properties if you want to set up a one-way SSL configuration or do not want to set up SSL at all. If you do not set the HttpClient properties on the agent and the TIBCO Enterprise Administrator server, the HttpClients residing on both of them are configured to "Trust All".
To enable SSL on the TIBCO Enterprise Administrator server, set these properties for the HttpServer and HttpClient residing on the TIBCO Enterprise Administrator server:

TIBCO Enterprise Administrator Server Properties
Property | Description
--- | ---
Properties for the HttpServer on the TIBCO Enterprise Administrator server
tea.http.keystore | The file name or URL of the key store location. For example: `tea.http.keystore =`"/Users/<username>/tea/keystore/httpserversslkeys.jceks"
tea.http.keystore-password | Password for the key store residing on the TIBCO Enterprise Administrator server. This is the password that was set when the key store was created. For example: `tea.http.keystore-password = "MyPassword"`
tea.http.cert-alias | Alias for the SSL certificate. The certificate can be identified by this alias in case there are multiple certificates in the trust store. For example: `tea.http.cert-alias = "httpserver"`
tea.http.key-manager-password | The password for the specific key within the key store. This is the password that was set when the key pair was created. For example: `tea.http.key-manager-password = "password"`
tea.http.truststore | The file name or URL of the trust store location. For example: `tea.http.truststore =` "/Users/<username>/tea/keystore/httpserverssltrusts.jceks"
tea.http.truststore-password | The password for the trust store. For example: `tea.http.truststore-password = "password"`
tea.http.want.client.auth | See section Guidelines to set the tea.http.want.client.auth and tea.http.need.client.auth Parameters below. This property is used for mutual authentication. For example: `tea.http.want.client.auth = true`
tea.http.need.client.auth | See section Guidelines to set the tea.http.want.client.auth and tea.http.need.client.auth Parameters below. This property is used for mutual authentication. For example: `tea.http.need.client.auth = true`
tea.http.exclude.protocols | The property to list the protocols to be excluded. To exclude multiple protocols, use comma as a delimiter. For example, `tea.http.exclude.protocols="SSLv3,TLS1"` If the property is not mentioned, the SSLV3 protocol is excluded. If TIBCO Enterprise Administrator server must support all protocols including SSLV3, set the property to be empty. For example, `tea.http.exclude.protocols=""`. Attention: When connecting using HTTPS, some versions of the popular browsers may be configured to use SSLv3 as the protocol. If you have problems accessing secured TIBCO Enterprise Administrator server (by default the SSLv3 is disabled) using the browser, follow the browser's user guide to configure that browser to excludeSSLv3 protocol.
Properties for the HttpClient on the TIBCO Enterprise Administrator server Only required if you want to set up a two-way SSL configuration
tea.http.client.keystore | The file name or URL of the key store location. For example: `tea.http.client.keystore = "/Users/<username>/tea/keystore/httpclientsslkeys.jceks"`
tea.http.client.keystore-password | The password for the key store residing on the client (agent). For example: `tea.http.client.keystore-password = "password"`
tea.http.client.cert-alias | Alias for the SSL certificate. The certificate can be identified by this alias in case there are multiple certificates in the trust store For example: `tea.http.client.cert-alias = "httpclient"`
tea.http.client.key-manager-password | The password for the specific key within the key store. For example: `tea.http.client.key-manager-password = "password"`
tea.http.client.truststore | The file name or URL of the trust store location. For example: `tea.http.client.truststore = "/Users/<username>/tea/keystore/httpclientssltrusts.jceks"`
tea.http.client.truststore-password | The password for the trust store. For example: `tea.http.client.truststore-password = "password"`
tea.http.client.exclude.protocols | The property to list the protocols to be excluded. To exclude multiple protocols, use comma as a delimiter. For example, `tea.http.exclude.protocols="SSLv3,TLS1"` If the property is not mentioned, the SSLV3 protocol is excluded. If TIBCO Enterprise Administrator server must support all protocols including SSLV3, set the property to be empty. For example, `tea.http.exclude.protocols=""`. Attention: When connecting using HTTPS, some versions of the popular browsers may be configured to use SSLv3 as the protocol. If you have problems accessing secured TIBCO Enterprise Administrator server (by default the SSLv3 is disabled) using the browser, follow the browser's user guide to configure that browser to excludeSSLv3 protocol.

Agent Properties To enable SSL on the agent, set the following properties for the HttpServer and HttpClient residing on the agent:
Property | Description
--- | ---
Properties for the HttpServer on the agent
tea.agent.http.keystore | The file name or URL of the key store location. For example: `tea.agent.http.keystore =`"/Users/<username>/tea/keystore/httpserversslkeys.jceks"
tea.agent.http.keystore.password | Password for the key store residing on the agent. This is the password that was set when the key store was created. For example: `tea.agent.http.keystore.password = "MyPassword"`
tea.agent.http.cert.alias | Alias for the SSL certificate. The certificate can be identified by this alias in case there are multiple certificates in the trust store. For example: `tea.agent.http.cert.alias = "httpserver"`
tea.agent.http.keymanager.password | The password for the specific key within the key store. This is the password that was set when the key pair was created. For example: `tea.agent.http.keymanager.password = "password"`
tea.agent.http.truststore | The file name or URL of the trust store location. For example: `tea.agent.http.truststore =` "/Users/<username>/tea/keystore/httpserverssltrusts.jceks"
tea.agent.http.truststore.password | The password for the trust store. For example: `tea.agent.http.truststore.password = "password"`
tea.agent.http.want.client.auth | See section Guidelines to set the tea.http.want.client.auth and tea.http.need.client.auth Parameters below. This property is used for mutual authentication. For example: `tea.agent.http.want.client.auth = true`
tea.agent.http.need.client.auth | See section Guidelines to set the tea.http.want.client.auth and tea.http.need.client.auth Parameters below. This property is used for mutual authentication. For example: `tea.agent.http.need.client.auth = true`
tea.agent.http.exclude.protocols | The property to list the protocols to be excluded. To exclude multiple protocols, use comma as a delimiter. For example, `tea.http.exclude.protocols="SSLv3,TLS1"` If the property is not set either using system properties or using agent Server API, the SSLV3 protocol is excluded. If TIBCO Enterprise Administrator agent must support all protocols including SSLV3, set the property to be empty. For example, `tea.http.exclude.protocols=""` Attention: When connecting using HTTPS, some versions of the popular browsers may be configured to use SSLv3 as the protocol. If you have problems accessing secured TIBCO Enterprise Administrator server (by default the SSLv3 is disabled) using the browser, follow the browser's user guide to configure that browser to excludeSSLv3 protocol.
Properties for the HttpClient on the Agent Only required if you want to set up a two-way SSL configuration
tea.agent.http.client.keystore | The file name or URL of the key store location. For example: `tea.agent.http.client.keystore = "/Users/<username>/tea/keystore/httpclientsslkeys.jceks"`
tea.agent.http.client.keystore.password | The password for the key store residing on the client (agent). For example: `tea.agent.http.client.keystore.password = "password"`
tea.agent.http.client.cert.alias | Alias for the SSL certificate. The certificate can be identified by this alias in case there are multiple certificates in the trust store. For example: `tea.agent.http.client.cert.alias = "httpclient"`
tea.agent.http.client.keymanager.password | The password for the specific key within the key store. For example: `tea.agent.http.client.keymanager.password = "password"`
tea.agent.http.client.truststore | The file name or URL of the trust store location. For example: `tea.agent.http.client.truststore = "/Users/<username>/tea/keystore/httpclientssltrusts.jceks"`
tea.agent.http.client.truststore.password | The password for the trust store. For example: `tea.agent.http.client.truststore.password = "password"`
tea.agent.http.client.exclude.protocols | The property to list the protocols to be excluded. To exclude multiple protocols, use comma as a delimiter. For example, `tea.http.exclude.protocols="SSLv3,TLS1"` If the property is not set either using system properties or using agent Server API, the SSLV3 protocol is excluded. If TIBCO Enterprise Administrator agent must support all protocols including SSLV3, set the property to be empty. For example, `tea.http.exclude.protocols=""` Attention: When connecting using HTTPS, some versions of the popular browsers may be configured to use SSLv3 as the protocol. If you have problems accessing secured TIBCO Enterprise Administrator server (by default the SSLv3 is disabled) using the browser, follow the browser's user guide to configure that browser to excludeSSLv3 protocol.

## Guidelines to set the tea.http.want.client.auth and tea.http.need.client.auth Parameters

Here are some guidelines for setting these parameters depending on the scenario you want to implement:

For this type of authentication... | setting the parameters in this combination... | results in...
--- | --- | ---
Certification-based two-way authentication | http.want.client.auth = true http.need.client.auth = false | The TEA server asks the client (web browser or agent) to provide its client certificate while handshaking. But the client chooses not to provide authentication information about itself, but the authentication process continues. So that would mean that the client certification is optional which in turn means that no certificate needs to be generated on the client. End Result The authentication process is successful.
http.want.client.auth = false http.need.client.auth = true | The TEA server asks the client (web browser or agent) to provide its client certificate while handshaking, but the client chooses not to provide authentication information about itself, the authentication process stops. So that would mean that the client certification is required which in turn means that a keypair and certificate must be generated on the client (agent). End Result The authentication process fails
http.want.client.auth = true http.need.client.auth = true | Same as the above case where the client certification is required and a keypair and certificate must be generated on the client (agent). End Result The authentication process fails
Certification-based one-way authentication | http.want.client.auth = false http.need.client.auth = false | Both of the parameters set to 'false' which means that it is a One-way Authentication, where only the client (web browser or agent) verifies the TEA server but the TEA server trusts all the clients without verification. Do not generate any certificates. End Result The authentication process is successful, as long as the user name and password provided by the agent are both correct.

Did you find this helpful?

Yes No
Great!
Thanks for taking the time to give us some feedback.
Sorry about that

Why wasn't this helpful? (check all that apply)

Could not find what I was looking for
Instructions confusing or unclear
Instructions did not work

Want to tell us more?

Please select at least one option or provide details about the issue!!

Error occurred while submitting feedback.

Error2 occurred while submitting feedback.

TIBCO® Enterprise Administrator

Copyright © 1996-2025. Cloud Software Group, Inc. All Rights Reserved.