IBM WebSphere V5.0 Security - CGISecurity

4. Select Signer Certificates in the drop-down list and click the Add button.
This will allow you to import the public certificate previously extracted from the
Web server plug-in keyfile.
Data type: Base64-encoded ASCII data
Certificate file name: WASpluginPubCert.arm
Location: c:\WebSphere\Appserver\etc\
Click OK when you are finished.
5. You will be prompted for a label name by which the trusted signer public
certificate will be known. Enter a label for the certificate: WASplugin.
6. Close the key database and quit ikeyman when you are finished.
Modifying the Web server plug-in file
The plug-in config file must be modified to reference the plug-in keyring and the
password stash file. This allows the transport protocol to be changed from HTTP
to HTTPS, using the certificates stored in the keyring.
A standard non-secure HTTP connection in the configuration looks like this:
The same entry, but secured, looks like this:
Note: the Transport XML tag has a body tag and a closing tag; make sure you
remove the slash ‘/’ from the end of the opening tag.
The transport protocol and SSL key properties can be specified for each
transport. In the previous example, the simple HTTP transport had been
secured. However, this does not make much sense, since the communication
from the client to the Web server and the plug-in is not secured. The secure port
for the WebSphere Application Server 9433 is already defined in the plug-in
configuration, and it is configured to use SSL/HTTPS.
It might be useful for the production environment to replace the original
plugin-key.kdb file with your own key file for the secure transport definition, port
9443.
Chapter 10. Administering WebSphere security 307