Step 2. Configure Secure Connections to LDAP (Optional)

You can optionally configure Data Collector to use one of the following methods to make secure connections to the LDAP server:

LDAP over SSL (LDAPS): LDAPS uses SSL to encrypt LDAP connections. LDAPS uses the ldaps:// scheme.
StartTLS: StartTLS can wrap an unencrypted connection with TLS during the connection process. This allows the same port to handle both unencrypted and encrypted connections. StartTLS uses the ldap:// scheme.

For either encryption method, if the LDAP server certificate is signed by a private Certificate Authority (CA) or not trusted by the default Java truststore, you must create a custom truststore file or modify a copy of the default Java truststore file to add the CA to the file. Then configure Data Collector to use the modified truststore file.

Use the same procedure to configure either secure method.

In the $SDC_CONF/ldap-login.conf file, set either the useLdaps or useStartTLS property to true.
By default, both properties are false and so Data Collector makes unencrypted connections to the LDAP server. If you set both properties to true, useStartTLS takes precedence.
Set the port property in the ldap-login.conf file as required, based on the method that you enabled:
- useLdaps - Use the port number for secure connections, typically 636.
- useStartTLS - Use the LDAP port number, typically 389.
If the LDAP server certificate is signed by a private CA or not trusted by the default Java truststore, create a custom truststore file or modify a copy of the default Java truststore file to add the CA to the file. Then configure Data Collector to use the modified truststore file.

By default, Data Collector uses the Java truststore file located in $JAVA_HOME/jre/lib/security/cacerts. If your certificate is signed by a CA that is included in the default Java truststore file, you do not need to create a truststore file and can skip this step.

In these steps, we show how to modify the default truststore file to add an additional CA to the list of trusted CAs. If you prefer to create a custom truststore file, see the keytool documentation.
Note: If you've already configured Data Collector to use a custom truststore file to enable HTTPS, then simply add this additional CA to the same modified truststore file that you created in Step 2. Create a Truststore File.
1. Use the following command to set the JAVA_HOME environment variable:
```
export JAVA_HOME=<Java home directory>
```
2. Use the following command to set the SDC_CONF environment variable:
```
export SDC_CONF=<Data Collector configuration directory>
```
  For example, for an RPM installation use:
```
export SDC_CONF=/etc/sdc
```
3. Use the following command to copy the default Java truststore file to the Data Collector configuration directory:
```
cp "${JAVA_HOME}/jre/lib/security/cacerts" "${SDC_CONF}/truststore.jks"
```
4. Use the following keytool command to import the CA certificate into the truststore file:
```
keytool -import -file <LDAP certificate> -trustcacerts -noprompt -alias <LDAP alias> -storepass <password> -keystore "${SDC_CONF}/truststore.jks"
```
  For example:
```
keytool -import -file  myLDAPServer.pem -trustcacerts -noprompt -alias MyLDAPServer -storepass changeit -keystore "${SDC_CONF}/truststore.jks"
```
5. Define the following options in the SDC_JAVA_OPTS environment variable:
  - javax.net.ssl.trustStore - Path to the truststore file on the Data Collector machine.
  - javax.net.ssl.trustStorePassword - Truststore password.
  using the method required by your installation type.
  For example, define the options as follows:
```
export SDC_JAVA_OPTS="${SDC_JAVA_OPTS} -Djavax.net.ssl.trustStore=/etc/sdc/truststore.jks -Djavax.net.ssl.trustStorePassword=mypassword -Xmx1024m -Xms1024m -server -XX:-OmitStackTraceInFastThrow"
```
  Or to avoid saving the password in the export command, save the password in a text file and then define the truststore password option as follows: -Djavax.net.ssl.trustStorePassword=$(cat passwordfile.txt)
  
  Then ensure that the password file is readable only by the user executing the export command.
Restart Data Collector to enable the changes.