IBM WebSphere V5.0 Security - CGISecurity

Table 10-3 WebSphere default key storesFileDummyServerKeyFile.jksDummyServerTrustFile.jksDummyClientKeyFile.jksDummyServerTrustFile.jksDescriptionserver-based key fileserver-based trust fileclient-based key fileclient-based trust fileThe key store type in this case is Java Key Store (JKS), a format that issupported by both WebSphere and the supplied key generation utility, ikeyman.This utility will be used in the next section to generate a new certificate. Thereare, generally, two options when deciding how to create a new certificate.►►Request that a CA generate the certificate on your behalf. This will probablyinvolve providing enough information so that the CA can validate the identityof the certificate requestor. The CA will create a new certificate, digitally sign itand then deliver it to the requestor, presumably in a secure fashion. PopularWeb browsers are pre-configured to trust certificates that are signed bycertain CAs and so no further client configuration is necessary in order for aclient to connect to the server (that this certificate relates to) via an SSLconnection. Therefore, CA-signed certificates are useful where configurationfor each and every client that will access the server is impractical.Generate a self-signed certificate. This may well be the quickest option andwill probably require fewer details in order to create the certificate. However,the certificate will not be signed by a CA. This may prove troublesome incertain cases. Every client that is likely to receive this certificate, in otherwords any client that will connect to this server over an SSL connection, willneed to be configured to trust the signer of this certificate. Since the certificatehas been self-signed, the signature is not likely to be in the client's trust fileand so must be added. If access to every client is impractical then thisconfiguration will simply not occur. Therefore, self-signed certificates are onlyuseful when each of the clients can be configured to trust the certificate.Note: It is technically possible in some cases to present a self-signedcertificate to a non-trusting client. In some Web browsers, for instance, whenthe certificate is received and is found not to match any of those listed in theclient's trust file, a prompt will appear asking if the certificate should be trustedfor the connection (or even added to the trust file).Chapter 10. Administering WebSphere security 263