IBM WebSphere V5.0 Security - CGISecurity

24.From the menu bar, select Key Database File -> Close. This will close thecurrent key store.The server's trust fileTo create the server’s trust file, repeat the first nine steps from “The server's keyfile” on page 264 (up to clicking OK on the password prompt) with a file name ofWASV5ServerTrustFile.jks. It is not necessary to populate the trust file with anycertificates at this stage.The client's key fileThe client's key file provides a client certificate during the SSL connectioninitialization. This certificate contains the identity of the caller that is notnecessarily restricted to establishing an SSL connection but may also be usedfor authentication purposes at a J2EE level. The creation of this key file is verysimilar to that of the server’s key file and so refer to “The server's key file” onpage 264 for details. The file name of the key file is WASV5ClientKeyFile.jks inthis sample, the certificate label is WASV5ClientSec and the extracted certificateis WASV5ClientSecPubCert.arm. The client certificate can be added to theserver’s trust file.1. Open WASV5ServerTrustFile.jks in ikeyman.2. Select Signer Certificates from the Key Database Content drop-down menu.3. Click Add.4. Enter the details for the client certificate (WASV5ClientSecPubCert.arm).5. Click OK.6. Enter the label for the certificate which is WASV5ClientSec.7. Click OK. The certificate should be added to the list of signer certificates.8. Close the file.The client's trust fileTo create the client’s trust file, repeat the first nine steps from “The server's keyfile” on page 264 (up to clicking OK on the password prompt) with a file name ofWASV5ClientTrustFile.jks. It will be necessary to add the server’s extractedcertificate as a signer certificate. The process for this is documented in “Theclient's key file” on page 270”.270 IBM WebSphere V5.0 Security Handbook