IBM WebSphere V5.0 Security - CGISecurity

Table 10-3 WebSphere default key stores
File
DummyServerKeyFile.jks
DummyServerTrustFile.jks
DummyClientKeyFile.jks
DummyServerTrustFile.jks
Description
server-based key file
server-based trust file
client-based key file
client-based trust file
The key store type in this case is Java Key Store (JKS), a format that is
supported by both WebSphere and the supplied key generation utility, ikeyman.
This utility will be used in the next section to generate a new certificate. There
are, generally, two options when deciding how to create a new certificate.
►
►
Request that a CA generate the certificate on your behalf. This will probably
involve providing enough information so that the CA can validate the identity
of the certificate requestor. The CA will create a new certificate, digitally sign it
and then deliver it to the requestor, presumably in a secure fashion. Popular
Web browsers are pre-configured to trust certificates that are signed by
certain CAs and so no further client configuration is necessary in order for a
client to connect to the server (that this certificate relates to) via an SSL
connection. Therefore, CA-signed certificates are useful where configuration
for each and every client that will access the server is impractical.
Generate a self-signed certificate. This may well be the quickest option and
will probably require fewer details in order to create the certificate. However,
the certificate will not be signed by a CA. This may prove troublesome in
certain cases. Every client that is likely to receive this certificate, in other
words any client that will connect to this server over an SSL connection, will
need to be configured to trust the signer of this certificate. Since the certificate
has been self-signed, the signature is not likely to be in the client's trust file
and so must be added. If access to every client is impractical then this
configuration will simply not occur. Therefore, self-signed certificates are only
useful when each of the clients can be configured to trust the certificate.
Note: It is technically possible in some cases to present a self-signed
certificate to a non-trusting client. In some Web browsers, for instance, when
the certificate is received and is found not to match any of those listed in the
client's trust file, a prompt will appear asking if the certificate should be trusted
for the connection (or even added to the trust file).
Chapter 10. Administering WebSphere security 263