Hello Harikrishna. For IIQ, I would go with a CA-signed certificate for IQService, especially in production. Satheesh’s link covers the IQService-side steps well, but that article is ISC using a self-signed cert on Virtual Appliances, so the VA parts do not apply to IIQ.
Basic setup:
- Configure IQService to use a TLS port:
IQService.exe -i -o <TLS_Port> - Register the account for client auth:
IQService.exe -a "DOMAIN\User"(client authentication is mandatory once TLS is on) - The cert needs a matching private key, Server Authentication EKU, and the IQService FQDN in both CN and SAN. No cert yet? Generate a CSR and have a trusted internal or third-party CA sign it.
- On the IIQ AD application, set the IQService host, TLS port, user/password, and tick Use TLS for IQService.
- Converting an existing instance? Disable the non-TLS port, then confirm with
IQService.exe -v.
For a fuller IIQ walkthrough (keystore imports, Tomcat truststore settings, restarts), see TLS Enablement for Active Directory [Important Pointers]. IIQ-specific config: Securing Communication Path Between IdentityIQ and IQService. Full cert/client-auth/port procedure: Configuring TLS and Client Authentication for IQService.
Self-signed is fine when no trusted CA is available, just not the first choice for production. before/after script execution requires TLS, so on a non-TLS setup those scripts are disabled.