Data Transformation Engine Intelligent Business Integration Reference Guide

Chapter 7 - Securing HTTP Communications Implementing an SSL Environment
Intelligent Business Integration Reference Guide
65
Digital Signatures and Certificates
A digital signature is used to sign or authenticate a message. A digital signature
uses a private key to encrypt a portion of the message. The corresponding public
key, which is given to everyone, is used to decrypt the message. This process
ensures the recipient that the message and its digital signature could have come
only from the owner of the private key corresponding to the public key that was
used to decrypt the message.
A digital certificate verifies the integrity of the signed message. A digital certificate
is a way to authenticate a person or information on a computer and is used to
implement public key encryption on Web servers. It is like a driver’s license; you
are provided assurance that the person or entity is truly who or what they say
they are. A Certificate Authority (CA) that acts as a third-party that both sides can
trust issues these “electronic credentials”.
Digital certificates are sent with the encrypted message in order to identify the
sender of the message and also to verify that the message was not altered after it
was sent.
Implementing an SSL Environment
A Secure Socket Layer (SSL) Security Option is available for Mercator products.
This option installs the necessary SSL libraries enabling you to connect to an
HTTPS URL and process secure HTTP transactions. The SSL Security Option
enables 40-bit and 128-bit SSL sessions, meaning that the HTTP transactions you
process can employ either 40-bit or 128-bit encryption.
To exchange encrypted data during an HTTP session using the Event Agent, HTTP
adapter, or FTP adapter, the following must be in place on your Web or application
server:
♦ SSL capabilities
♦ Public-key encryption infrastructure
♦ Digital certificate
Note The Security Option includes HTTPS, FTPS, OpenPGP, and S/MIME adapters. Refer
to the Resource Adapters Library for documentation about each adapter.
Event Agent
If you are using the Mercator Event Agent to receive external Web requests
through the Event Server, a digital certificate must be installed on the Event Agent
in order to process secure HTTP transactions.