Enabling TLS support during setup
Enable TLS support in the server.
To enable TLS support in the server, you should complete one of the following tasks during the setup procedure:
-
Provide a key store that contains the certificate to use.
-
Make the installer generate a self-signed certificate.
When using the setup
tool in interactive mode, it prompts you for the information that it needs to configure secure communication, as shown in the following example.
Do you want to enable the Directory Server services (Available State, Available or Degraded State, Configuration, Consent, Directory REST API, Documentation, SCIM2, and Swagger UI) and Administrative Console over HTTPS? After setup, you can selectively enable or disable individual services and applications by configuring the HTTPS Connection Handler (yes / no) [yes]: yes On which port should the Directory Server accept connections from HTTPS clients? [443]: 443 On which port should the Directory Server accept connections from LDAP clients? [389]: 389 Do you want to enable LDAPS? (yes / no) [yes]: yes On which port should the Directory Server accept connections from LDAPS clients? [636]: 636 Do you want to enable StartTLS? (yes / no) [yes]: yes Certificate server options: 1) Generate self-signed certificate (recommended for testing purposes only) 2) Use an existing certificate located on a Java Keystore (JKS) 3) Use an existing certificate located on a PKCS12 keystore 4) Use an existing certificate on a PKCS11 token Enter option [1]: 2 Java Keystore (JKS) path: /ca/ds1-keystore Keystore PIN: {password} Truststore options: 1) Generate a default JKS truststore 2) Use an existing JKS truststore 3) Use an existing PKCS12 truststore Enter option [1]: 2 JKS truststore path: /ca/truststore Truststore password (can be blank): {password}
When using setup
in non-interactive mode, use the following arguments to configure TLS support.
Argument | Description |
---|---|
|
Server enables support for LDAPS (LDAP over TLS) on the specified TCP port. |
|
Server enables support for HTTPS for SCIM, the Directory REST API, and the web-based administration console on the specified TCP port. |
|
LDAP connection handler enables support for the StartTLS extended operation. |
|
|
|
Server uses the specified Java KeyStore (JKS) key store to obtain the certificate chain that it presents to clients that use LDAPS, HTTPS, and the StartTLS extended operation. |
|
Server uses the specified PKCS #12 key store to obtain the certificate chain that it presents to clients that use LDAPS, HTTPS, and the StartTLS extended operation. |
|
Server uses a PKCS #11 key store, like a hardware security module, to obtain the certificate chain that it presents to clients that use LDAPS, HTTPS, and the StartTLS extended operation. The Java Virtual Machine (JVM) must already be configured to access the appropriate key store through PKCS #11. |
|
Password that is needed to interact with the specified JKS, PKCS #12, or PKCS #11 key store. The |
|
Path to the file that contains the password needed to interact with the specified JKS, PKCS #12, or PKCS #11 key store. |
|
Alias of the private key entry in the specified key store that contains the certificate chain to present to clients during TLS negotiation. This argument is optional but recommended if the key store contains multiple certificates. |
|
Server uses the specified JKS trust store to determine whether to trust certificate chains that are presented to it during TLS negotiation. |
|
Server uses the specified PKCS #12 trust store to determine whether to trust certificate chains that are presented to it during TLS negotiation |
|
Password that is needed to interact with the specified JKS or PKCS #11 trust store. |
|
Path to the file that contains the password needed to interact with the specified JKS or PKCS #11 trust store. |
The following example command sets up the PingDirectory server in non-interactive mode with an existing certificate.
$ ./setup \
--no-prompt \
--acceptLicense \
--ldapPort 389 \
--ldapsPort 636 \
--httpsPort 443 \
--enableStartTLS \
--useJavaKeyStore config/keystore \
--keyStorePasswordFile config/keystore.pin \
--certNickname server-cert \
--useJavaTrustStore config/truststore \
--trustStorePasswordFile config/truststore.pin \
--baseDN dc=example,dc=com \
--rootUserDN "cn=Directory Manager" \
--rootUserPasswordFile root-pw.txt \
--maxHeapSize 10g \
--encryptDataWithPassphraseFromFile encryption-settings-password.txt \
--instanceName ds1 \
--location Austin \
--noPropertiesFile
Ping Identity Directory Server 8.0.0.0
Initializing ..... Done
Configuring Directory Server ..... Done
Configuring Certificates ..... Done
Starting Directory Server ..... Done
Access product documentation from docs/index.html