General Information
Encrypted Connections
With Intrexx, you can set up encrypted connections (SSL/TLS). In certain scenarios, such as the connection between the front-end web server and the client (browser), it is necessary to establish encrypted connections.
TLSv1.3, TLSv1.2
We recommend using TLSv1.3 as the encryption protocol between the browser and the web server. In cases where older browsers and client operating systems—or clients that do not support TLSv1.3—must be supported, TLSv1.3 can also be used in conjunction with TLSv1.2. Older versions of TLS and SSL are insecure and should therefore no longer be used.
Certificates
You need certificates to set up encrypted connections. Certificates are files that contain a variety of information, including the public key and, in some cases, the private key.
You can purchase certificates from certification authorities. For test systems, you may also use so-called self-signed certificates, if necessary. Intrexx is typically integrated into the local public-key infrastructure (PKI).
Intrexx as a data provider (Intrexx as a server)
Intrexx can act as a data provider. This is the case, for example, when you make data available to an external consumer via an OData connection. To establish an encrypted connection between Intrexx and the data consumer, you must store a certificate in Intrexx that contains both the public and private keys for the connection. (See the "Providing Data" section for more information.)
A similar scenario is the connection between the front-end web server and the client (browser). In this case, it is not Intrexx that (directly) provides the data, but rather the front-end web server. However, even in this case, a certificate with a public and private key must be stored (on the front-end web server). (See Scenario 1 - Encrypted connection between the front-end web server and the browser.)
Intrexx as a Data Consumer (Intrexx as a Client)
Intrexx can act as a consumer of data. Intrexx offers a wide range of integrations that allow data from third-party systems to be processed or displayed. In this case, you simply need to store public-key certificates in Intrexx so that an encrypted connection to the third-party system can be established. (See the section on " Consume data" for more information.)
Certificate Storage Locations - Keystores
Intrexx as a Client If Intrexx acts as a client, you must store the required certificates in the portal's (central) certificate store (Portal > Portal Properties > Certificates).
In the central certificate store, you'll find a wide range of certificates from trusted certification authorities. These are shipped with the JDK included in Intrexx. So, if you want to set up an encrypted connection with Intrexx that uses a certificate signed by a trusted certificate authority, you do not need to manually add it to the certificate store.
Intrexx as a Server If Intrexx acts as a server, you must manually create your own certificate store.
Where the certificate store should be created depends on the specific data integration.
Front-End Web Server: For production portals, you typically use a front-end web server (IIS or NGINX).
In this case, the certificate is stored outside of Intrexx.
Certificate Store Formats
Certificate stores (keystores) are created in .JKS or PKCS12 format.