IBM WebSphere V5.0 Security - CGISecurity

Exchanging public certificates
The following two sections will describe how to exchange certificates between
the Web Container keystore and the Web server plug-in keyfile.
In order to import the certificates into the keystores as described in the next two
sections, you will have to copy over the two certificates and the extracted .arm
files to both machines, the Web server, and the WebSphere server.
1. Copy WASpluginPubCert.arm from the Web server machine to the
WebSphere machine. The source directory in our case is c:\ihs\conf\keys,
while the destination is: c:\WebSphere\Appserver\etc.
2. Copy WASWebContainerPubCert.arm from the WebSphere machine to the
Web server machine. The source directory in our case is c:\was\etc, while the
destination is: c:\IBMHttpServer\conf\keys.
Importing the certificate into the Web server plug-in keyfile
1. On the Web server machine, launch the ikeyman utility that supports the CMS
key database format.
2. From the ikeyman menu select Key Database File -> Open and select the
previously created key database file: WASplugin.kdb.
3. At the password prompt window, enter the password then click OK.
4. Select Signer Certificates from the drop-down list, then click the Add button.
This will allow you to import the public certificate previously extracted from the
embedded HTTP server/Web Container keystore.
Data type: Base64-encoded ASCII data
Certificate file name: WASWebContainerPubCert.arm
Location: c:\WebSphere\Appserver\etc\
Click OK when you are finished.
5. You will be prompted for a label name by which the trusted signer public
certificate will be known. Enter a label for the certificate: WASWebContainer.
6. Close the key database and quit ikeyman when you are finished.
Importing the certificate into the Web Container keystore
1. On the WebSphere machine, launch the IBM JKS capable ikeyman version
that ships under the WebSphere bin directory.
2. From the ikeyman menu, select Key Database File -> Open and select the
previously created WASWebContainer.jks file.
3. At the password prompt, enter the password for the keyfile, then click OK.
306 IBM WebSphere V5.0 Security Handbook