IBM Configure IBM Content Collector to use SSL to communicate with IBM FileNet P8. - United States  TECHNOTE (FAQ)

QUESTION
 How do I configure IBM Content Collector (ICC) to use SSL to communicate with IBM FileNet P8 for all components? 

CAUSE
ICC communicates with P8 in several different components. Depending on the API used for the various components, P8 certificates need to be installed in multiple places.

ANSWER
Do the following steps to install P8 certificates. Depending on your business requirements, you may not use all of the components so some steps may not be necessary. 

 * First obtain a P8 server certificate by accessing the P8 Content Engine ping page using this URL: https://<ce_server>:<ssl_port>/FileNet/Engine 
   
   From the browser, view the certificate and copy it to a file. Use it for later steps. 
   Do not use the MTOM page as it may not produce the same certificate that ICC requires. 
   
    
   
   
 * Perform this step if you are going to run ICC Initial Configuration to create new document classes in P8 object store.  * To import the certificate, issue the following command, whereICCInstallDiris the directory of your Content Collector installation andP8CertificatFileis the certificate for the FileNet P8 server: "ICCInstallDir\java\jre\bin\keytool.exe" -import -file P8CertificateFile
      -keystore "ICCInstallDir\java\jre\lib\security\cacerts" -alias afup8 
      
      
    * At the password prompt, enter the password for the JRE keystore. (The default password is changeit.) 
    * Enterywhen asked whether to trust the certificate. 
    * Run ICC Initial Configuration and you should then be able to validate the connection with P8 using SSL.
   
   

 * Perform this step if you are going to run task route archiving to P8:  * Add the P8 certificate into the Windows Trusted Root Certificate Authorities via the Microsoft Management Console. 
    * For more details instructions, refer to this document:
      http://www-01.ibm.com/support/docview.wss?uid=swg21610358 [http://www-01.ibm.com/support/docview.wss?uid=swg21610358]
   
   

 * Perform this step if you are going to retrieve, restore, or search for documents from P8:  * Start ikeyman from ICC-install-directory\AFUWeb\ewasfor the ICC embedded web application server. 
    * In the ikeyman utility, select Key Database File>Open, and select PKCS12as key database type. 
    * In theLocationfield, specify theWAShome\profiles\profile name\config\cells\cell name\nodes\node name\trust.p12file.
      ReplaceWAShome,profile name,cell name, andnode namewith the proper values of your web application server installation. 
    * Click OK. 
    * When prompted for a password, enter the password. ClickOK. The default password is WebAS. 
    * Under theSigner certificateslist, clickAddto add the P8 certificate. 
    * Exit ikeyman utility and restart IBM Content Collector Web Application service. 
    * For more details instructions, refer to this document: http://www.ibm.com/support/knowledgecenter/SSAE9L_4.0.1/com.ibm.content.collector.doc_kc/installing/t_afu_establish_trust_relationship.dita?lang=en [http://www.ibm.com/support/knowledgecenter/SSAE9L_4.0.1/com.ibm.content.collector.doc_kc/installing/t_afu_establish_trust_relationship.dita?lang=en]

Question: How to connect ICC to P8 using SSL? In the ICC Configuration Manager, http has been changed to https in the P8 URL. But validating the connection to P8 fails. 

Answer: ICC communicates with P8 in several different components. Depending on the API used for the various components, P8 certificates need to be installed in multiple places.