IBM WebSphere V5.0 Security - CGISecurity

WebSphere supports the concept of two types of key store which are refered toas a key file and a trust file. A key file contains a collection of certificates, eachone of which may be presented during an SSL connection initiation in order toprove identity. Incidentally, a key file will also contain the associated private keyfor each certificate. A server will manage at least one key file, although a clientmay also manage one. A trust file contains a collection of certificates that areconsidered trustworthy and against which the presented certificate will bematched during an SSL connection initiation in order to assure identity. A clientwill typically manage at least one trust file, although a server may also manageone (see Figure 10-20 on page 262).Splitting the certificates into two files, key file and trust file, increases security.The certificate stores are essential parts of the secure communication since thecertificates provide the base for trust. The most sensitive element is the privatecertificate, the one that is presented for identification. This certificate must besecured carefully, and once it is stored in the keystore protected by a password,it should not be opened again. On the other side, there is the list of signercertificates which is subject to change; new signers or trust parties may need tobe added, which means that the store needs to be opened.WebSphere V5.0 ServerWebSphere V5.0 ClientKey FileTrust FileKey FileTrust FilePrivateKeyPublicKeyPublicKeySigning CASigning CAPrivateKeyPublic PrivateKey KeyPrivateKeyPrivate PublicKeySigning CASigning CAFigure 10-20 Correlation between server and client key storesWhile this demonstrates how the two types of key store may be used, rememberthat it is also possible to combine the key and trust files. WebSphere provides thefollowing key stores in the /etc directory.262 IBM WebSphere V5.0 Security Handbook