Open topic with navigation

Configure IDOL > Security > Secure Communications > SSL in IDOL

# SSL in IDOL

You can configure Secure Socket Layer (SSL) communications in IDOL in a number of different ways. For details about the configuration parameters available, refer to the IDOL Server Reference.

You can set these configuration parameters in different locations for different components, and in some cases for different ports of the same component (for example the ACI and Index port). In each case, you set the `SSLConfig` parameter to the name of a configuration section that contains the SSL configuration parameters for that component.

    [Server]
    SSLConfig=SSLOptions

    [SSLOptions]
    SSLMethod=...

In most cases, you can share one set of SSL options for multiple use (for example, incoming and outgoing connections to different components). In some scenarios a component might need to use different SSL settings to communicate with different components.

For a minimal SSL setup you must set `SSLMethod`, `SSLPrivateKey`, and `SSLCertificate`. This configuration provides encryption without authentication.

## Basic encryption only

The following example configuration sets up all of the ACI Servers to accept only SSL connections, so that all traffic between them is encrypted.

For this configuration, every ACI Server must have the following configuration:

    [Server]
    SSLConfig=SSLEncryptionOnly

    [SSLEncryptionOnly]
    SSLMethod=SSLv23
    SSLPrivateKey=/path/to/privatekey
    SSLCertificate=/path/to/certificate

Those components with an index port also have:

    [IndexServer]
    SSLConfig=SSLEncryptionOnly

You must configure the components to use SSL to talk to each other. For example, in a DAH you may need to add something like:

    [DAHEngine0]
    Host=12.3.4.56
    Port=9000
    SSLConfig=SSLEncryptionOnly

## Server and Client Certificate Signing Checks

The following example setup enforces that all certificates that the client and server use are signed by a trusted Certificate Authority, and that the certificates are used only on the machines they were intended for.

    [Server]
    SSLConfig=SSLOptions

    [SSLOptions]
    SSLMethod=SSLv23
    SSLPrivateKey=/path/to/privatekey
    SSLCertificate=/path/to/certificate
    SSLCheckCommonName=True
    SSLCACertificate=/path/to/certificate.authority.certificate

Note: If you try to access an ACI Server through a Web browser then you must import a similarly signed certificate into your browser certificate store.

## IDOLProxy Configuration

There are three ways of configuring SSL through IDOL Proxy:

- StandaloneProxy mode. In this mode, IDOL Proxy distributes actions, and each component is configured separately, often on separate machines. In this case, you configure IDOL Proxy with the SSL settings for communications with each component.

      [Server]
      SSLConfig=SSLOptions
      StandAloneProxy=True

      [Content]
      Host=anothermachine
      ACIPort=9992
      SSLConfig=SSLOptions
      ...

- SSL gateway. In this mode, only the IDOL Proxy uses SSL communications, and child components use plain HTTP. To provide encryption, you must ensure that all external requests go through IDOL Proxy.

      [Server]
      SSLConfig=SSLOptions

      [IndexServer]
      SSLConfig=SSLOptions

- Full SSL. In this mode, all components run in SSL mode.

  Note: In this case, you must also configure the Agentstore component with the `SSLIDOLComponents` configuration parameter, as well as `SSLConfig`.

      [Server]
      SSLIDOLComponents=True
      SSLconfig=SSLOptions

      [IndexServer]
      SSLConfig=SSLOptions

      [DataDRE]
      SSLConfig=SSLOptions

      [AgentDRE]
      SSLConfig=SSLOptions

      [Agent]
      SSLConfig=SSLOptions
      IndexSSLConfig=SSLOptions

      [Viewing]
      SSLConfig=SSLOptions

  If you want SSL on the service port, you can also add:

      [Service]
      SSLConfig=SSLOptions

      [DIHEngineN]
      ServiceSSLConfig=SSLOptions

## License Server

Components can request a license from an SSL-enabled License Server by using the following configuration:

    [License]
    SSLConfig=SSLOptions

## Available Ciphers

ACI servers log the list of available ciphers on startup if they are configured to run in SSL mode.

Related Topics

- Secure Communications

- Encryption in IDOL

© 2016 Hewlett Packard Enterprise Development LP | Send documentation feedback to HPE Close We welcome your comments! To open the configured email client on this computer, open an email window. Otherwise, copy the information below to a web mail client, and send this email to AutonomyTPFeedback@hpe.com. Product: Topic Title: Help Topic: Feedback:

_HP_HTML5_bannerTitle.htm