# TLS Enablement for Active Directory \[Important Pointers\]

**URL:** <https://developer.sailpoint.com/discuss/t/tls-enablement-for-active-directory-important-pointers/85674>\
**Category:** IIQ Community Knowledge Base\
**Tags:** iqservice, identityiq\
**Created:** [October 16, 2024, 4:06pm UTC](https://developer.sailpoint.com/discuss/t/tls-enablement-for-active-directory-important-pointers/85674 "2024-10-16T16:06:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Akhil](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@Akhil](https://developer.sailpoint.com/discuss/u/Akhil)\
**Post date:** [October 16, 2024, 4:06pm UTC](https://developer.sailpoint.com/discuss/t/tls-enablement-for-active-directory-important-pointers/85674/1 "2024-10-16T16:06:10Z")

</div>

## Secure the Active Directory application by using the following communication paths based on the operations performed.

- IdentityIQ and Active Directory Domain Controller/ Target system: For read operations
- IdentityIQ and IQService: For provisioning operations
- IQService and Active Directory Domain Controller/ Target system: For (Write) provisioning operations

1. Import the DC certificate in to SailPoint App Servers both UI & Task Servers using Java Key store (certificate should be in .cer format)
2. Import the DC certificate in to SailPoint App Servers both UI & Task Servers using the Windows default method for Client (Certificate will be in .pfx format) Authentication.  
Make sure the DC certificate should be placed in Trusted Root Certificate Authorities
3. Import the IQ Service Servers Certificates into SailPoint App Servers both UI & Task Servers using Java Key store (certificate should be in .cer format)
4. Import the DC certificate in to SailPoint IQ Service using the Windows default method for Client Authentication. Make sure the DC certificate should be placed in Trusted Root Certificate Authorities
5. The IQ Service should be Update Subject name to lookup IQService’s X509 certificate (requires restart) IQ Service -m command

Additionally, Whitelist the IP or FQDN of Load Balancer if present To whitelist the IPs and FQDN, run the command with **IP/FQDN**. For example, IQService.exe -w {\<IP/FQDN\>}

1. Add the Tomcat Java options The custom keystore is used, then add the following lines in catalina.bat (Tomcat Configuration) and iiq.bat configuration file as follows:  
-Djavax.net.ssl.trustStore=“”  
-Djavax.net.ssl.trustStorePassword=“”

2. Restart the Tomcat Service.

3. Restart IQ service

# In Identity IQ Application :

To enable TLS communication, complete the following: For Active Directory Application

1. On the application configuration page, select the Use TLS for IQService checkbox.
2. For more information on the TLS communication between IQService and an IdentityIQ, see IQService.  
#3. Select Save.

Test the Application connectivity after saving the configuration.

Also, check if the TLS is enabled in server.

1. In registry Editor navigate to this path and check the TLS configuration

Computer\HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client

---

<div class="post-metadata">

**Author:** ![Muhammad\_Mustafa](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/muhammad_mustafa/32/27611_2.png) [@Muhammad\_Mustafa](https://developer.sailpoint.com/discuss/u/Muhammad_Mustafa)\
**Post date:** [October 20, 2024, 5:16pm UTC](https://developer.sailpoint.com/discuss/t/tls-enablement-for-active-directory-important-pointers/85674/2 "2024-10-20T17:16:47Z")

</div>

Thanks @Akhil for sharing!

---

<div class="post-metadata">

**Author:** ![Akhil](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@Akhil](https://developer.sailpoint.com/discuss/u/Akhil)\
**Post date:** [March 11, 2025, 6:04am UTC](https://developer.sailpoint.com/discuss/t/tls-enablement-for-active-directory-important-pointers/85674/3 "2025-03-11T06:04:55Z")

</div>

Thanks @Muhammad_Mustafa