SSL/TLS options

SSL/TLS is a method for ensuring secure communications between computers. It involves the exchange of digital certificates between the client and the server to ensure communications between them are secure and encrypted.

Important: This feature is an add-on purchased separately from the rest of Medallia Experience Cloud. Ask your Medallia expert about purchasing this to add advanced SSL features to your configuration.

SSL uses certificates to ensure the privacy and integrity of the data exchanged between computers. The authentication can be unidirectional (standard SSL) or bidirectional (mutual SSL). Check the sections below to see how each of these methods handles the exchange of certificates.

How standard SSL works

The authentication does not have to be mutual or two-way; it can be unidirectional. SSL/TLS options can be set up so that only the server certificate is required.

Standard SSL uses only one certificate:

  • A server certificate installed on the system that requests access (the client).

In this type of authentication (one-way SSL authentication), the server authenticates its identity presenting the server certificate to the client.

Diagram showing the steps to perform certificate-based 1-way authentication

How mutual SSL works

This authentication method is mutual or two-way. Mutual SSL includes two certificates:

  • A server certificate installed on the system that grants access (the server) and on the system that requests access (the client).

    Note: SSL/TLS server certificates can be self-signed certificates or issued and signed by a public and trusted certificate authority.

  • A client certificate also installed on the client and the server.

When the client is ready to communicate with the server, it begins by requesting access to a protected resource. The server then presents its certificate to the client. The client must verify the certificate declared by the server. If the server certificate is valid, the client certificate is passed to the server to verify it and authenticate the connection. If the certificate is valid, the server grants access to the protected resource requested by the client.

Diagram showing the steps to perform certificate-based mutual authentication

SSL/TLS options in Omni Exporter

To set up HTTP call outs using mutual SSL:

  1. The company admin generates the server certificate and then:

    1. Installs the server certificate on the company system so that their endpoint can declare it.

    2. Sends the server certificate to the Experience Cloud admin.

  2. The Experience Cloud admin generates the client certificate using one of these methods:

    • Use the command prompt or the terminal window locally to create a self-signed certificate.

    • Request it from the client.

    • If the client requests an official Medallia certificate, file a CERT issue in Jira.

      Provide the CN for the certificate, a Certificate Signing Request if it applies, and where it will be used.

      Note: By default, certificates are valid for two years. When a certificate needs an extension, clarify it in the Jira issue.
      Important: For its official certificates, Medallia uses a domain-based validation mechanism, so the CN must be a Medallia subdomain that we can validate with the public certificate authority, for example:
      "tenant-omniexporter-mutualssl-auth.medallia.com"

  3. The Experience Cloud admin installs the client certificate in Experience Cloud, for information about this step, see X.509 Identities:

    1. Sends the certificate to the company admin.

    2. Enters the server certificate and the client certificate for the exporter using the SSL/TLS options that will process both certificates.

      To complete this step, the Experience Cloud admin:

      1. Enters the server certificate in the text-box.

      2. Selects the client certificate from the drop-down list.

        Server certificate and client certificate specific options section

There is no predefined maximum number of certificates per company. It is possible to enter certificates one after the other in the text-box. All certificates in the text-box will be accepted. However, there is a limit of 3 certificates for the certificate Info box: only the first 3 certificates will be displayed with their details.

Screen capture showing SSL/TLS options with server and client certificate info

Note: the Experience Cloud admin can also enter the server URL in lieu of the server certificate, and the system will retrieve the server certificate and process it.