Editing access manager properties to enable TLS

After you install certificates on the SafeLinx Administrator and the access manager, configure the access manager to require remote SafeLinx Administrator clients to use secure connections.

Before you begin

Before you can establish a secure connection between the SafeLinx Administrator and the access manager, you use a key management tool such as OpenSSL to prepare X.509 certificates on both of them.

About this task

When certificates are in place on both endpoints, modify a few access manager settings to complete the TLS configuration.

By default, the access manager does not require SafeLinx Administrator sessions to use secure protocols. Enable the setting Force remote SafeLinx Administrator connections to use TLS to require secure connections.

The access manager properties specify the PKCS12 keystore file that contains the access manager certificates and the keystore password. If you did not use the default files, update these settings.

You can also specify the TLS ciphers that the access manager uses to encrypt traffic.

The following procedure describes how to edit the access manager properties so that you can begin using TLS to secure the SafeLinx Administrator-access manager connection.

Procedure

  1. From the Resources page in the SafeLinx Administrator, right-click Access Manager, and then click Properties.
  2. On the Security page, click Force remote SafeLinx Administrator connections to use TLS to configure the access manager to accept only remote SafeLinx Administrator connections that use TLS.
  3. On the TLS page, review the entries in the fields PKCS12 keystore file and Keystore password. If you did not use the default keystore file sl-default.p12 and password trusted, specify them here. Specify the full path to the keystore file.
  4. On the TLS page, specify the ciphers to use to encrypt data that the access manager exchanges with the SafeLinx Administrator.
  5. From the SafeLinx Administrator, restart the SafeLinx Server.
    You must restart the SafeLinx Server to activate changes to certificates in the PKCS12 keystore file .
  6. Close and restart the remote SafeLinx Administrator to test the connection.