To enable TLS support in the server, you should complete one of the following tasks during the setup procedure:

  • Provide a key store that contains the certificate to use.
  • Make the installer generate a self-signed certificate.

When using the setup tool in interactive mode, it prompts you for the information that it needs to configure secure communication, as shown in the following example.

Do you want to enable the Directory Server services (Available State,
Available or Degraded State, Configuration, Consent, Directory REST API,
Documentation, SCIM2, and Swagger UI) and Administrative Console over
HTTPS?  After setup, you can selectively enable or disable individual
services and applications by configuring the HTTPS Connection Handler
(yes / no) [yes]: yes
 
On which port should the Directory Server accept connections from HTTPS
clients? [443]: 443
 
On which port should the Directory Server accept connections from LDAP
clients? [389]: 389
 
Do you want to enable LDAPS? (yes / no) [yes]: yes
On which port should the Directory Server accept connections from LDAPS
clients? [636]: 636
 
Do you want to enable StartTLS? (yes / no) [yes]: yes
 
Certificate server options:
 
    1)  Generate self-signed certificate (recommended for testing purposes
        only)
    2)  Use an existing certificate located on a Java Keystore (JKS)
    3)  Use an existing certificate located on a PKCS12 keystore
    4)  Use an existing certificate on a PKCS11 token
 
Enter option [1]: 2
 
Java Keystore (JKS) path: /ca/ds1-keystore
Keystore PIN: {password}
 
Truststore options:
 
    1)  Generate a default JKS truststore
    2)  Use an existing JKS truststore
    3)  Use an existing PKCS12 truststore
 
Enter option [1]: 2
 
JKS truststore path: /ca/truststore
Truststore password (can be blank): {password}

When using setup in non-interactive mode, use the following arguments to configure TLS support.

Argument Description

--ldapsPort {port}

Server enables support for LDAPS (LDAP over TLS) on the specified TCP port.

--httpsPort {port}

Server enables support for HTTPS for SCIM, the Directory REST API, and the web-based administration console on the specified TCP port.

--enableStartTLS

LDAP connection handler enables support for the StartTLS extended operation.

--generateSelfSignedCertificate

setup generates a self-signed certificate that is presented to clients that use LDAPS, HTTPS, and the StartTLS extended operation.

--useJavaKeyStore {path}

Server uses the specified Java KeyStore (JKS) key store to obtain the certificate chain that it presents to clients that use LDAPS, HTTPS, and the StartTLS extended operation.

--usePKCS12KeyStore {path}

Server uses the specified PKCS #12 key store to obtain the certificate chain that it presents to clients that use LDAPS, HTTPS, and the StartTLS extended operation.

--usePKCS11KeyStore

Server uses a PKCS #11 key store, like a hardware security module, to obtain the certificate chain that it presents to clients that use LDAPS, HTTPS, and the StartTLS extended operation. The Java Virtual Machine (JVM) must already be configured to access the appropriate key store through PKCS #11.

--keyStorePassword {password}

Password that is needed to interact with the specified JKS, PKCS #12, or PKCS #11 key store. The setup tool assumes that the private key password matches the key store password.

--keyStorePasswordFile {path}

Path to the file that contains the password needed to interact with the specified JKS, PKCS #12, or PKCS #11 key store.

--certNickname {alias}

Alias of the private key entry in the specified key store that contains the certificate chain to present to clients during TLS negotiation. This argument is optional but recommended if the key store contains multiple certificates.

--useJavaTrustStore {path}

Server uses the specified JKS trust store to determine whether to trust certificate chains that are presented to it during TLS negotiation.

--usePKCS12TrustStore {path}

Server uses the specified PKCS #12 trust store to determine whether to trust certificate chains that are presented to it during TLS negotiation

--trustStorePassword {password}

Password that is needed to interact with the specified JKS or PKCS #11 trust store.

--trustStorePasswordFile {path}

Path to the file that contains the password needed to interact with the specified JKS or PKCS #11 trust store.

The following example command sets up PingDirectory Server in non-interactive mode with an existing certificate.

$ ./setup \
     --no-prompt \
     --acceptLicense \
     --ldapPort 389 \
     --ldapsPort 636 \
     --httpsPort 443 \
     --enableStartTLS \
     --useJavaKeyStore config/keystore \
     --keyStorePasswordFile config/keystore.pin \
     --certNickname server-cert \
     --useJavaTrustStore config/truststore \
     --trustStorePasswordFile config/truststore.pin \
     --baseDN dc=example,dc=com \
     --rootUserDN "cn=Directory Manager" \
     --rootUserPasswordFile root-pw.txt \
     --maxHeapSize 10g \
     --encryptDataWithPassphraseFromFile encryption-settings-password.txt \
     --instanceName ds1 \
     --location Austin \
     --noPropertiesFile
 
 
Ping Identity Directory Server 8.0.0.0
 
Initializing ..... Done
Configuring Directory Server ..... Done
Configuring Certificates ..... Done
Starting Directory Server ..... Done
 
Access product documentation from docs/index.html