> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/security-configuration/setting-up-ssl-https/setting-up-a-custom-keystore-in-collibra-dq.md).

# Setting up a custom keystore in Collibra DQ

This topic shows you how to set up the keystore and truststore file for the Data Quality & Observability (self-hosted) application to use across various deployment types.

{% tabs %}
{% tab title="Standalone" %}
{% stepper %}
{% step %}
Create a Java KeyStore, as demonstrated in [Setting up SSL (HTTPS)](/data-quality-self-hosted/security-configuration/setting-up-ssl-https.md).
{% endstep %}

{% step %}
Copy the JKS or PKCS12 file to the location inside the VM where DQ Web is running. For example, **file:///etc/ssl/dev-keystore.jks**
{% endstep %}

{% step %}
Update the owl-env.sh with the following properties:

1. **For SSL**
   1. ```
      SERVER_SSL_KEY_STORE=file:///etc/ssl/dev-keystore.jks
      ```
   2. ```
      SERVER_SSL_KEY_ALIAS=alias                     #This is the alias used when creating the keystore
      ```
   3. ```
      SERVER_SSL_KEY_PASS=\<keystore-password\>        #The password of the keystore
      ```
   4. ```
      SERVER_SSL_KEY_TYPE=JKS                        #This is either JKS or PKCS12
      ```
2. **For SAML**
   1. ```
      SAML_KEYSTORE_FILE=file:///etc/ssl/dev-keystore.jks
      ```
   2. ```
      SAML_KEYSTORE_ALIAS=alias                     #This is the alias used when creating the keystore
      ```
   3. ```
      SAML_KEYSTORE_PASS=\<keystore-password\>        #The password to the keystore
      ```

{% endstep %}

{% step %}
Restart the Data Quality & Observability (self-hosted) application.\ <i class="fa-chevrons-right">:chevrons-right:</i> Data Quality & Observability (self-hosted) now uses the keystore file for SSL and SAML.

{% hint style="info" %}
Depending on the IdP configuration you many need to re-import the SP metadata for SAML. To do this, download the Data Quality & Observability (self-hosted) SP metadata from the **https\://\<your\_dq\_environment\_url>/saml/metadata** endpoint and share it with the IdP to configure the SP.
{% endhint %}
{% endstep %}
{% endstepper %}
{% endtab %}

{% tab title="Cloud Native" %}
To use a custom keystore or truststore in a Cloud Native deployment requires you to mount the keystore file inside the web pod.

### Enabling SSL

{% stepper %}
{% step %}
Create a K8s secret using the keystore file:

```
kubectl create secret generic dq-ssl-secret --from-file <file-name.jks> --namespace <dev>
```

{% endstep %}

{% step %}
Enable SSL with the following Helm Charts variable:

```
--set global.web.tls.enabled=true --set global.web.tls.key.alias=<alias-name> --set global.web.tls.key.pass=<keystore-pass>
```

{% endstep %}

{% step %}
Start the Data Quality & Observability (self-hosted) application.
{% endstep %}
{% endstepper %}

### Using SAML with SSL enabled

{% stepper %}
{% step %}
Create a K8s secret using the keystore file:

```
kubectl create secret generic dq-ssl-secret --from-file <file-name.jks> --namespace <dev>
```

{% endstep %}

{% step %}
Set the SAML keystore parameters through the following Helm Charts variable:

```
--set global.web.security.saml.keyStoreFile=file:///etc/ssl/dqkeystore.jks --set global.web.security.saml.keyStoreAlias=<alias-name> --set global.web.security.saml.keyStorePass=<keystore-pass>
```

{% endstep %}

{% step %}
Start the Data Quality & Observability (self-hosted) application.
{% endstep %}
{% endstepper %}

### Using SAML without SSL enabled

{% hint style="warning" %}
When using SAML in its current implementation, you must enable SSL to use a custom keystore. If you rely on a Load Balancer to manage SSL, you can still enable SSL by stopping SSL at the Load Balancer. You can also enable an HTTP port to allow a Load Balancer to connect to it, as shown in step 3 below. In a future release, we plan to provide support for custom keystores without SSL enabled.
{% endhint %}

{% stepper %}
{% step %}
Create a K8s secret using the keystore file:

```
kubectl create secret generic dq-ssl-secret --from-file <file-name.jks> --namespace <dev>
```

{% endstep %}

{% step %}
Set the SAML keystore parameters through the following Helm Charts variable:

```
--set global.web.security.saml.keyStoreFile=file:///etc/ssl/dqkeystore.jks --set global.web.security.saml.keyStoreAlias=<alias-name> --set global.web.security.saml.keyStorePass=<keystore-pass>
```

{% endstep %}

{% step %}
(Optional) If you want to include a non-SSL HTTP port, manually update the Web ConfigMap with the following property:

```
SERVER_HTTP_ENABLED=true
```

{% endstep %}

{% step %}
Start the Data Quality & Observability (self-hosted) application.
{% endstep %}
{% endstepper %}
{% endtab %}
{% endtabs %}

{% hint style="info" %}
For information on rotating or migrating encryption keys, go to [Migrating keystores](/data-quality-self-hosted/security-configuration/migrating-keystores.md)
{% endhint %}