CA Risk Authentication Administration Guide › Configure SSL › Prepare for SSL Communication › Enable SSL Between CA Advanced Authentication and CA Risk Authentication Case Management Server › For Server Refresh and Restart Activities › Two-Way SSL

Two-Way SSL

To set up two-way SSL communication between CA Advanced Authentication and Case Management Queuing Server for server management activities:

1. Access CA Advanced Authentication in a Web browser window.
2. Log in to CA Advanced Authentication as the MA.
3. Activate the Services and Server Configurations tab.
4. Ensure that the CA Risk Authentication tab is active.
5. Under System Configuration, click the Trusted Certificate Authorities link to display the CA Risk Authentication Server Trusted Certificate Authorities page.
6. Set the following information on the page:
   • In the Name field, enter the name for the SSL truststore.
   • Click the Browse button adjacent to the first Root CAs field and navigate to and select the root certificate of the application server where CA Advanced Authentication is deployed.
7. Click the Save button.
8. Under Instance Configuration, click the Protocol Configuration link to display the Protocol Configuration page.
9. Select the Server Instance for which you want to configure SSL communication.
10. In the List of Protocols section, click the Case Management Queuing Administration link.

    The page to configure the Case Management Queuing Administration protocol appears.

11. Configure the following fields:
    • Ensure that the Protocol Status is Enabled.

      If not, then select the Change Protocol Status option and then from the Action list, select Enable.

    • Ensure that the Port is set to the correct SSL port value.
    • Select SSL from the Transport list.
    • If you want to store the SSL key on an HSM, then select the Key in HSM option.
    • Click the Browse button adjacent to the Server Certificate Chain field to select the Case Management Server root certificate.
    • (Only if you did not select the Key in HSM option) Click the Browse button adjacent to the Server Private Key field to select the Case Management Server private key.
    • Select Client Store that you created in Step 6.
12. Click the Save button.
13. Restart Case Management Queuing Server:
    • On Windows: Click the Start button, navigate to Settings, Control Panel, Administrative Tools, and Services. Double-click Arcot Case Management Queuing Service from the listed services.
    • On UNIX Platforms: Navigate to <install_location>/arcot/bin/ and specify the ./casemanagementserver start command in the console window.
14. Under System Configuration, click the CA Risk Authentication Connectivity link to display the CA Risk Authentication Connectivity page.
15. On the CA Risk Authentication Connectivity page:
    • Ensure that the IP address or the host name of Case Management Server is correctly set in the Server field.
    • Ensure that the Server Management Port is also set to point the Case Management Server port that is open to Server Management requests.
    • Select SSL from the Transport list.
    • Click the Browse button adjacent to the Server CA Root Certificate field to navigate to and select the Case Management Server root certificate.
    • Click the Browse button adjacent to the Client Certificate-Key Pair in PKCS#12 field to navigate to and select the root certificate of the application server where CA Advanced Authentication is deployed.
    • Enter the PKCS#12 file password in the Client PKCS#12 Password field.
16. Click the Save button.
17. Restart Case Management Queuing Server:
    • On Windows: Click the Start button, navigate to Settings, Control Panel, Administrative Tools, and Services. Double-click Arcot Case Management Queuing Service from the listed services.
    • On UNIX Platforms: Navigate to <install_location>/arcot/bin/ and specify the ./casemanagementserver start command in the console window.
18. Restart CA Advanced Authentication.
19. Verify that Case Management Server is enabled for SSL communication by performing the following steps:
    1. Navigate to the following location:
    2. Open the arcotriskfortcasemgmtserverstartup.log file in a text editor.
    3. Check for the following line:

       Started listener for [Case Management Admin] [7780] [SSL] [srvmgrwsprotocol]
       

       If you located this line, then two-way SSL was set successfully.

    4. Close the file.