TLS Configuration for IQ Service

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Hi Sailors,

We need to configure TLS for IQ service in Sailpoint IIQ. What is the process and How can we achieve. Kindly give the best approach to configure TLS for IQ service.

Thank you,

Harikrishna

2

@Harikrishna_06 : Kindly go through below URL

3

Hello Harikrishna. For IIQ, I would go with a CA-signed certificate for IQService, especially in production. Satheesh’s link covers the IQService-side steps well, but that article is ISC using a self-signed cert on Virtual Appliances, so the VA parts do not apply to IIQ.

Basic setup:

  1. Configure IQService to use a TLS port: IQService.exe -i -o <TLS_Port>
  2. Register the account for client auth: IQService.exe -a "DOMAIN\User" (client authentication is mandatory once TLS is on)
  3. The cert needs a matching private key, Server Authentication EKU, and the IQService FQDN in both CN and SAN. No cert yet? Generate a CSR and have a trusted internal or third-party CA sign it.
  4. On the IIQ AD application, set the IQService host, TLS port, user/password, and tick Use TLS for IQService.
  5. Converting an existing instance? Disable the non-TLS port, then confirm with IQService.exe -v.

For a fuller IIQ walkthrough (keystore imports, Tomcat truststore settings, restarts), see TLS Enablement for Active Directory [Important Pointers]. IIQ-specific config: Securing Communication Path Between IdentityIQ and IQService. Full cert/client-auth/port procedure: Configuring TLS and Client Authentication for IQService.

Self-signed is fine when no trusted CA is available, just not the first choice for production. before/after script execution requires TLS, so on a non-TLS setup those scripts are disabled.

4

Hi @punna0001 ,

Thanks for the suggestion. Here we had the private key in my certificate folder in Windows server. I need to get the public key. How can I get? is there any steps to achieve? If yes, can you please provide the steps.

Thanks,

Harikrishna

5

If you already have the certificate with its private key on the Windows server, you do not need to generate a separate public key. The public key is already included in that certificate.

Open certlm.msc → Personal → Certificates and locate the IQService certificate.

If you need the public certificate for trust/configuration, right-click it → All Tasks → Export → choose No, do not export the private key → export it as a .cer file.

If you only have a private-key file and no certificate, then you need to create a CSR using that key and have your CA issue the matching certificate.

6

Thanks for the suggestions. Issue is resolved now.

Thanks,

Harikrishn