Question
Zurich
BR
Last activity: 19 Jan 2024 11:07 EST
Configuring PEGA PDC using a custom keystore
We are configuring the PDC in our applications, but for security reasons our application does not use the default java keystore (/home/tomcat/jdk/jre/lib/security/) instead of it we are using a jks provided by the security team which contains all of our organization's certificates.
We understand that in order to configure the PDC we need to install the certificate, but we cannot import the certificate into our organization's jks because it is shared with other applications thoughout the company,
so we created a customized jks and imported the PDC certificate into it.
We have tried these steps:
We began by attempting to include the new JKS in the web.xml file for ports 443 and 8843. However, upon starting the environment, we started encountering the same certificate errors in the PDC services.
The second attempt involved introducing the JVM variable (-Djavax.net.ssl.trustStore) in the setenv file, referencing the new JKS created. However, the error persisted.
In the third attempt we pointed the -Djavax.net.ssl.trustStore var to the /home/tomcat/jdk/jre/lib/security/cacerts and with it we achieved success.
We need to know if the use of /cacerts is mandatory to use de pdc.
Image of third attempt:
***Edited by Moderator Marije to add Support Case INC-B466 ; update capability tags***
Accepted Solution
Pegasystems Inc.
GB
@GabrielE9965 I can see that you logged a support incident the same time when you logged the original question: INC-B466
It sounds like GCS helped resolve your issue.
Explanation provided by GCS:
----------------------------
CA certs is a truststore which is used for authentication of other peers. Jks is just a keystore that is used for your own certificates .
Since you are connecting to cloud hosted PDC, CA certs are mandatory for PDC to work .
Your setup works when you have the certifcate in the Java CA certs but does not work when using the separate jks.
So we recommend using the successfully working scenario.
---------------------------
Yesterday in the ticket you confirmed that you found the solution to this scenario in the existing Pega Cloud Security and data protection documentation:
Data-in-transit encryption
When you are using a custom trust store, you have to add amazon trust services to ensure to connectivity to Pega Cloud, in this case to the PDC.
I will mark Accept Solution to this explanation as per the support ticket.