Skip to main content


         This documentation site is for previous versions. Visit our new documentation site for current releases.      
 

Importing an X.509 certificate

Updated on March 15, 2022

You can import X.509 certificates that are defined in keystore instances of type JKS or PKCS12. They become active without your having to restart the server.

A typical application server is deployed with a truststore file, which contains the trusted certificates. To add a certificate, you use the keytool utility to update the cacerts.jks file or the equivalent server-level truststore file, and then you restart the server.

Pega Platform includes a platform truststore to which you can import X.509 certificates. When a certificate needs to be used for transport layer security, Pega Platform looks for the certificate in the platform truststore, and then in the application server-level (JVM) truststore. You can add certificates to the platform truststore without having to restart the server, which is useful when TLS certificates are changed for reasons such as key expiration.

The platform truststore is used for rules that reference a truststore, which include certificates used for transport layer security in connectors and integration services, keystores, authentication services, OAuth 2.0 providers, and web service policies.

To view and update the platform truststore, run the activities described below using Dev Studio.

  1. To view the contents of the platform truststore, run the pyInstanceList report of the Data-Admin-Security-Certificate class.
  2. To add, update, and delete certificates in the platform truststore, run the appropriate activities in the Data-Admin-Security-Certificate class. For more information, see Managing X.509 certificates.
  • Managing X.509 certificates

    Beginning with Pega Platform 8.4, you can import your X.509 certificates directly into the Pega Platform truststore.

  • Expiring certificate notifications

    Beginning with Pega Platform 8.7, you can configure notifications when X.509 certificates are about to expire. By enabling notifications, you can renew your certificates on time.

  • Enabling encrypted communication between nodes

    For on-premises deployments, enable encryption for communication among nodes to prevent unauthorized access to the data that is transported across node clusters.

  • Previous topic Creating a keystore instance for an external key management service
  • Next topic Managing X.509 certificates

Have a question? Get answers now.

Visit the Support Center to ask questions, engage in discussions, share ideas, and help others.

Did you find this content helpful?

Want to help us improve this content?

We'd prefer it if you saw us at our best.

Pega.com is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us