Knowledge Discovery 25.1
Knowledge Discovery Expert

# SSL in Knowledge Discovery

You can configure Secure Socket Layer (SSL) communications in Knowledge Discovery in a number of different ways. For details about the configuration parameters available, refer to the appropriate component reference, for example the Content Component Help.

You can set these configuration parameters in different locations for different components, and in some cases for different ports of the same component (for example the ACI and Index port). In each case, you set the `SSLConfig` parameter to the name of a configuration section that contains the SSL configuration parameters for that component.

    [Server]
    SSLConfig=SSLOptions

    [SSLOptions]
    SSLMethod=...

In most cases, you can share one set of SSL options for multiple use (for example, incoming and outgoing connections to different components). In some scenarios a component might need to use different SSL settings to communicate with different components.

For a minimal SSL setup you must set `SSLMethod`, `SSLPrivateKey`, and `SSLCertificate`. This configuration provides encryption without authentication.

## Basic encryption only

The following example configuration sets up all of the ACI Servers to accept only SSL connections, so that all traffic between them is encrypted.

For this configuration, every ACI Server must have the following configuration:

    [Server]
    SSLConfig=SSLEncryptionOnly

    [SSLEncryptionOnly]
    SSLMethod=TLSV1.2
    SSLPrivateKey=/path/to/privatekey
    SSLCertificate=/path/to/certificate

Those components with an index port also have:

    [IndexServer]
    SSLConfig=SSLEncryptionOnly

You must configure the components to use SSL to talk to each other. For example, in a DAH you may need to add something like:

    [DAHEngine0]
    Host=12.3.4.56
    Port=9000
    SSLConfig=SSLEncryptionOnly

## Server and Client Certificate Signing Checks

The following example setup enforces that all certificates that the client and server use are signed by a trusted Certificate Authority, and that the certificates are used only on the machines they were intended for.

    [Server]
    SSLConfig=SSLOptions

    [SSLOptions]
    SSLMethod=SSLv23
    SSLPrivateKey=/path/to/privatekey
    SSLCertificate=/path/to/certificate
    SSLCheckCommonName=True
    SSLCACertificate=/path/to/certificate.authority.certificate

NOTE: If you try to access an ACI Server through a Web browser then you must import a similarly signed certificate into your browser certificate store.

## Proxy component Configuration

There are three ways of configuring SSL through the Proxy component:

- StandaloneProxy mode. In this mode, Proxy distributes actions, and each component is configured separately, often on separate machines. In this case, you configure Proxy with the SSL settings for communications with each component.

      [Server]
      SSLConfig=SSLOptions
      StandAloneProxy=True

      [Content]
      Host=anothermachine
      ACIPort=9992
      SSLConfig=SSLOptions
      ...

- SSL gateway. In this mode, only the Proxy uses SSL communications, and child components use plain HTTP. To provide encryption, you must ensure that all external requests go through Proxy.

      [Server]
      SSLConfig=SSLOptions

      [IndexServer]
      SSLConfig=SSLOptions

- Full SSL. In this mode, all components run in SSL mode.

  NOTE: In this case, you must also configure the Agentstore component with the `SSLIDOLComponents` configuration parameter, as well as `SSLConfig`.

      [Server]
      SSLIDOLComponents=True
      SSLconfig=SSLOptions

      [IndexServer]
      SSLConfig=SSLOptions

      [DataDRE]
      SSLConfig=SSLOptions

      [AgentDRE]
      SSLConfig=SSLOptions

      [Agent]
      SSLConfig=SSLOptions
      IndexSSLConfig=SSLOptions

      [Viewing]
      SSLConfig=SSLOptions

  If you want SSL on the service port, you can also add:

      [Service]
      SSLConfig=SSLOptions

      [DIHEngineN]
      ServiceSSLConfig=SSLOptions

## License Server

Components can request a license from an SSL-enabled License Server by using the following configuration:

    [License]
    SSLConfig=SSLOptions

## Available Ciphers

ACI servers log the list of available ciphers on startup if they are configured to run in SSL mode.

Related Topics

- Secure Communications

- Encryption in Knowledge Discovery

Copyright 2024 Open Text
Version 25.1 | Last updated January 2025

Send documentation feedback

Close

Send documentation feedback

To send feedback using your default email client, open an email window.

Otherwise, send your feedback and the information below to MFI-swpdl.idoldocsfeedback@opentext.com.

We appreciate your feedback!

Product: Knowledge Discovery 25.1

Topic Title: SSL in Knowledge Discovery