Skip to Main Content
Integration


This is an IBM Automation portal for Integration products. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).


Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas
  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.


Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.


Status Not under consideration
Workspace App Connect
Created by Guest
Created on Jun 11, 2014

Broker or Exec Group keystore file default certificate

A Broker-wide keystore file or Exec Group keystore file does not support the notion of a default certificate which is a security exposure.

Assume I have one certificate in a keystore file. The certificate is to be used by MsgFlow A's SOAPRequest Node to call a highly restricted web service via HTTPS.

Now, assume I deploy MsgFlow B that will use the same keystore file. The flow calls ANY web service using a SOAPRequest Node but the Node's 'SSL client authentication key alias' property is empty string. This means MsgFlow B can effectively impersonate MsgFlow A and call the highly restricted web service because MsgFlow B will be assigned the same certificate that MsgFlow A points to in its SOAPRequest Node

Idea priority High
RFE ID 54710
RFE URL
RFE Product IBM App Connect Enterprise (formerly IBM Integration Bus)
  • Admin
    Ben Thompson
    Reply
    |
    May 12, 2022

    RFE Review. As part of our policy for regularly reassessing aged RFEs we have recently discussed this enhancement request again. After our last update in February last year, there have not been any further demonstrations of community support for this idea. It is also noted that users have the option of always providing an alias for every flow they deploy, or alternatively deploying flows with different certificate requirements into separate containers; so there are other ways to achieve the desired end goal with this topic. Unfortunately on this occasion we do not intend to carry the suggestion further forward.

  • Guest
    Reply
    |
    Feb 2, 2021

    RFE Review. Apologies for the length of time this RFE has been held in Uncommitted Candidate status. Although open for over 6 years now, there has not been much community support for this idea. We are still open to enhancing this area - though it would be unlikely we would provide a default certificate given that the product does not automatically enforce the use of keystore/truststore in an effort to make the out of the box experience as straight forward as possible (although obviously in production circumstances, configuration of all security aspects of the product are to be encouraged). More likely, we could configure flows to require a certificate key alias to be set if the user opted in to a new configuration default (as opposed to using the first certificate found). We will continue to monitor the RFE for popularity; status is maintained as Uncommitted Candidate.

  • Guest
    Reply
    |
    Oct 7, 2015

    Due to processing by IBM, this request was reassigned to have the following updated attributes:
    Brand - WebSphere
    Product family - Integration
    Product - IBM Integration Bus (WebSphere Message Broker) - IIB

    For recording keeping, the previous attributes were:
    Brand - WebSphere
    Product family - Connectivity and Integration
    Product - IBM Integration Bus (WebSphere Message Broker) - IIB

  • Guest
    Reply
    |
    Aug 5, 2014

    Thanks for raising this requirement. The idea of a default certificate sounds reasonable, and we will investigate this as part of our next set of security enhancements.