4.2 Configuring TLS/SSL Communication with the Identity Governance Database

On the server where you deployed Identity Governance, stop Tomcat.

Log in to the PostgreSQL server for Identity Governance.

Stop Postgres.

To generate a passphrase-protected certificate, enter the following command:

openssl req -new -text -out cert.req

To remove the passphrase so the server can start the postmaster automatically, enter the following command:

openssl rsa -in privkey.pem -out cert.pem

To convert the certificate into a self-signed certificate, enter the following command:

openssl req -x509 -in cert.req -text -key cert.pem -out cert.cert

Copy the following files to the data directory of the PostgreSQL installation:

To change the permission of the files, navigate to the /opt/netiq/idm/apps/postgresql/data/ directory and enter the following commands:

chown postgres:postgres server.key
chown postgres:postgres server.crt
chmod 600 server.key 

In a text editor, change the SSL setting in the $PGDATA/postgresql.conf file to on. For example:

ssl=on
ssl_cert_file = '/opt/netiq/idm/apps/postgresql/data/server.crt' # (change requires restart)
ssl_key_file = '/opt/netiq/idm/apps/postgresql/data/server.key'  # (change requires restart)

Save and close the file.

Start Postgres.

(Optional) To verify that SSL communication is enabled for Postgres, complete the following steps:

Add the server.crt that you created in Step 7 to the cacert. For example, enter the following command:

keytool -import -trustcacerts -alias ar -file server.crt -keystore /opt/netiq/idm/apps/jre/lib/security/cacerts

Start Tomcat.

Ensure that you update the Identity Governance databases to recognize the secured connection.

For more information, see Enabling the Identity Governance Databases for SSL Communication.

Download and unpack the SSL helper scripts named ssl.ca-0.1.tar.gz.

Create a certification request using Oracle Wallet Manager (/opt/oracle/product/11gR1/db/owm) using the following commands:

su –oracle
owm

Select Wallet > New.

Enter your password, then select Yes to create folders for the wallet.

Fill in the requested information, then select OK.

Highlight the certification request, then select Operations > Export Certificate Request.

Save the file with the extension .csr in the folder where you extracted ssl.ca-0.1.tar.gz then save the wallet.

Create a self-signed root certificate by running the new-root-ca.sh script in the ssl.ca-0.1 folder that you extracted in the previous step to create a file called ca.crt.

To run the script that creates the self-signed server certificate, enter the following command:

./sign-server-cert.sh CerReq

Import the ca.crt into the Oracle wallet as a trusted certificate and import the certificate-request-filename.crt as a user certificate.

Enable auto-login and save the wallet so that it is now ready for use.

To configure Oracle advanced security and listener configuration on the database server, run the following commands:

su – oracle
netmgr

Select Profile > Select Network Security > SSL.

Ensure that the sqlnet.ora and listener.ora files mention the WALLET.

(Conditional) If the SSL_CLIENT_AUTHENTICATION parameter is not set, the default setting is TRUE and clients are required to present a certificate during the SSL handshake. If you do not need client authentication, disable it with the following parameter added to the end of the $TNS_ADMIN/listener.ora and $TNS_ADMIN/sqlnet.ora files: SSL_CLIENT_AUTHENTICATION=FALSE

Restart the listener:

lsnrctl stop
lsnrctl start

Ensure that you update the Identity Governance databases to recognize the secured connection.

For more information, see Enabling the Identity Governance Databases for SSL Communication.