Configuration/Setup for securing PI messages with certificates

[mark_meilleur]

Hello Experts,

I'm looking for some guidance/suggestions/direction in regards to installing and using certificates when exchanging data with trading partners via PI 7.0. It's something new to us and it's been a bit of a struggle.

In scenario 1, we want to send to, and receive from, xml documents with a partner. We currently send from our PI system, but want to receive the messages back thru an F5 network (?) which would decrypt the message and pass it along to PI. This also takes care of load-balancing.

In scenario 2, we want to exchange EDI messages using the AS2 Adapter from Seeburger. Again, messages would be sent from PI and received by the F5 network.

The F5 would act as the SSL termination point (if that's the correct term), and pass the decrypted message to PI via a normal http transfer.

We are storing our partners' certificates within PI, and configuring the communication channels to use them. Is this correct? Do they need to be stored on the F5 as well? Do we then give them our certificate from the F5, or do they need a certificate from our PI server, or both?

I guess what I'm looking for is some straight-forward SSL 101 documentation, especially where it applies to middleware like the F5. Thanks in advance for any help you can give.

[mark_meilleur]

Thank you both Lucas and Kenneth! You have been most helpful.

Regards,

Mark

[KennethEriksen]

Hi,

Just a quick note on the certificates; if you want to encrypt messages sent from PI you need the public key of the receiver stored in PI (J2EE key store) with which to encrypt the messages. When receiving files back from partners, they would need to encrypt the messages with the public key of F5 certificate. F5 would then use its private key to decrypt the message before passing to PI.

So, yes, you are correct to store the certificates of your partners in PI which will be used in encryption of outbound messages. F5 would only need the private keys of the certificate that your partners have encrypted with, no need for PI certificates to be stored in F5 (unless you also need digital signatures).

Hope this helps.

Br,

Kenneth

[Former Member]

For SSL configuration on Java/XI, please check the document below.

http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/964f67ec-0701-0010-bd88-f995abf4e...