SSL
Quick answer
Configure TLS on the app server with a valid certificate and keystore, and import target-system certificates so connectors trust them.
Key takeaways
- Prerequisites for SSL
- Step-by-step install path
- Common pitfalls and fixes
- Verification after install
TLS/SSL protects credentials and data in transit, both for users reaching the IdentityIQ UI and for connectors talking to target systems. A production deployment must enforce HTTPS for the web tier and trust the certificates of every system it integrates with. Certificate problems are, in turn, one of the most common sources of connectivity failures, so understanding the keystore/truststore model pays off.
Two sides of TLS in IdentityIQ
- Inbound: the UI and REST APIs should be served over HTTPS, terminated at Tomcat's HTTPS connector or an upstream load balancer.
- Outbound: when connectors talk to targets over TLS (LDAPS, HTTPS APIs), IdentityIQ must trust those systems' certificates via its truststore.
Step by step
- 1. Obtain a valid certificate for the IdentityIQ hostname from a trusted CA.
- 2. Configure the keystore and HTTPS connector (in
server.xmlor on the load balancer) to present that certificate. - 3. Enforce HTTPS for the UI and REST, redirecting or disabling plain HTTP.
- 4. Import target certificates into IdentityIQ's truststore so connectors trust the systems they call.
- 5. Test the full chain, including any intermediate CA certificates.
Certificate lifecycle
Certificates expire, and an expired signing or server certificate silently breaks SSO and connector connectivity. Track expiry dates and rotate ahead of time. When a connector suddenly fails with a TLS or trust error, an expired or untrusted certificate is the first thing to check.
Verify
Confirm the UI serves over HTTPS with a valid, fully-chained certificate and no browser warnings, and that TLS-based connectors aggregate successfully.
Common pitfalls
- Incomplete certificate chain, missing intermediate CA certs.
- Target certs not imported into the truststore, breaking connectors.
- Expired certificates taking down SSO or connectivity.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
What are the prerequisites for SSL?
- A. The application and app-server logs, which usually point to database, Java or permission issues.
- B. Confirm the app server starts, the schema is present, and login works.
- C. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
Show answer
C. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
How do you verify the install?
- A. Confirm the app server starts, the schema is present, and login works.
- B. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
- C. The application and app-server logs, which usually point to database, Java or permission issues.
Show answer
A. Confirm the app server starts, the schema is present, and login works.
Confirm the app server starts, the schema is present, and login works.
Where do you look first on failure?
- A. The application and app-server logs, which usually point to database, Java or permission issues.
- B. Confirm the app server starts, the schema is present, and login works.
- C. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
Show answer
A. The application and app-server logs, which usually point to database, Java or permission issues.
The application and app-server logs, which usually point to database, Java or permission issues.