SSL two-way authentication using Universal Messaging
Tags: ssl, authentication, integration
Published: 2021-08-10 10:20:52

---
title: SSL two-way authentication using Universal Messaging
published: true
date: 2021-06-03 11:54:20 UTC
tags: #ssl, #authentication, #integration 
canonical_url: https://tech.forums.softwareag.com/t/ssl-two-way-authentication-using-universal-messaging/241881
---

## Introduction:

Using Universal Messaging, the user should be able to create Two-way SSL authentication (UM authenticates itself via certificate and require IS to authenticate itself with certificate). This article details the steps on creating the two-way SSL connection alias and publish and subscribe messages using Integration server.

## Pre-Requisites

1. Generate **server** key,cert, keystore and truststore files using OpenSSL and by following below commands:
- openssl genrsa -out diagserverCA.key 2048
- openssl req -x509 -new -nodes -key diagserverCA.key -sha256 -days 1024 -out  
diagserverCA.pem
- openssl pkcs12 -export -name server-cert -in diagserverCA.pem -inkey diagserverCA.key -out  
serverkeystore.p12
- keytool -importkeystore -destkeystore server.keystore -srckeystore serverkeystore.p12 -  
srcstoretype pkcs12 -alias server-cert
- keytool -import -alias client-cert -file diagclientCA.pem -keystore server.truststore
- keytool -import -alias server-cert -file diagserverCA.pem -keystore server.truststore
2. Generate **client** key,cert, keystore and truststore files using OpenSSL and by following  
below commands
- openssl genrsa -out diagclientCA.key 2048
- openssl req -x509 -new -nodes -key diagclientCA.key -sha256 -days 1024 -out  
diagclientCA.pem
- openssl pkcs12 -export -name client-cert -in diagclientCA.pem -inkey diagclientCA.key -out  
clientkeystore.p12
- keytool -importkeystore -destkeystore client.keystore -srckeystore clientkeystore.p12 -  
srcstoretype pkcs12 -alias client-cert
- keytool -import -alias server-cert -file diagserverCA.pem -keystore client.truststore
- keytool -import -alias client-cert -file diagclientCA.pem -keystore client.truststore

### Creating server and client configuration in IS and UM

Once we have generated the client and server keystore files we can configure them in IS and UM as shown below.  
Configurating Keystore and Truststore alias in IS:  
• In IS, navigate to Security> Keystore page and click on Create keystore alias and enter the  
below values  
Alias : mqttKeystore  
Type: PKCS12  
Provider: SUN  
Location: Complete path of Client keystore file  
Password: Client Keystore password

• Similarly create Truststore alias by navigating to Security> Keystore page and click on Create  
truststore alias and enter the below values  
Alias: mqttTruststore  
Type: JKS  
Provider: SUN  
Location: Complete path of Client truststore file  
Password: Client truststore password

![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/e/c/ec7bcb82e038272dee6509d70faf9ae3ec589129.png)

![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/9/c/9ce242f82cd37a470e30db83bbd6fe7f3689b679.png)

Configuring server certificates in UM:  
• In Enterprise Manager, navigate to the ‘Comms’ tab and click on '‘Add Interface’ button  
• Select Type as nsps and enter port 8883 and save changes  
• Select the newly added row for 8883 port and navigate to certificates sub-tab  
• Update the values as mentioned as below  
Key store path: Complete path of server keystore  
key store password  
Trust store path: Complete path of server truststore  
Trust store password: server truststore password  
Private key password: key password  
CA store password: truststore password

![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/d/c/dc13b6f26922c801f08f4f27d20cc82cf73e2ebe.png)

### Creating and enabling the 2way SSL connection

![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/6/6/669623ea6b4a08d0295f37dcbd1ac9c82c1d95e2.png)

![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/d/7/d70fdd345953a682596b70c424a23beb09fe006c.png)

### Verifying publish and Subscribe of messages to topic on UM using Integration Server  
• Launch designer and connect to integration sever.  
• Create package and folder MQTT and MQTT\_Test in designer  
• Create publish flow service in MQTT\_Test folder using the built-in  
service **pub.mqtt:publish**.

![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/8/a/8a4e33e4d2308f38b38e67a1833170892d0c5a34.png)

![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/c/9/c990a59d85512b5d26385cd4f6c544a0f6b41a79.png)

• Create another flow service subscribe to check the server log in integration server if the message is successfully subscribed from MQTT Server Topic  
 ![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/3/f/3fe08e148d3b2881bed8d954acc6d34cd5974d96.png)  
 ![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/e/5/e5d95b55a1add757e0c4a84bb3e280a596438c04.png)  
 ![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/5/0/505332de81d8b7e4f8cd779c157866485057237a.png)  
• Integration Server can subscribe to topics by creating an MQTT trigger. The MQTT trigger receives messages published to the topic on the MQTT server and then invokes a trigger service to process the messages.  
•Integration Server uses an MQTT connection alias to create a connection to the MQTT server. An invocation of the **pub.mqtt:publish** service requires the MQTT connection alias to publish the message to the MQTT server. Similarly, an MQTT trigger specifies the MQTT connection alias that it uses to identify the MQTT server from which it retrieves messages and on which the trigger creates subscriptions.  
 ![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/e/b/ebbe5450963b21385b3ff9081cf924775b543803.png)  
• Run the Publisher service  
 ![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/0/7/07698ceb30a4fbd8431cb44e4f90ba0a2bfcdafc.png)

### Verify message in server log of integration server  
 ![image](https://aws1.discourse-cdn.com/techcommunity/original/3X/1/b/1b6d666b2b6641db3da8f8a0143ade435d8e6672.png)

[Read full topic](https://tech.forums.softwareag.com/t/ssl-two-way-authentication-using-universal-messaging/241881)