IBM WebSphere V5.0 Security - CGISecurity

Web server plug-inWeb ContainerKeyring.kdbPersonal CertificatesSigner CertificatesKeyFile.jksTrustFile.jksPrivateKeyPublicKeyPrivate PublicKeyKeysPrivate PublicKeyPublicKeyPrivateKeyFigure 10-44 CertificatesFigure 10-44 illustrates the exchange of the public certificate keys associatedwith each peer participating in the secure SSL communication.Generating a self-signed certificate for the Web server plug-inThe Web server plug-in requires a keyring to store its own private and publickeys and to store the public certificate from the Web container’s keyfile.The following steps will guide you through the process of generating aself-signed certificate for the Web server plug-in.1. Create a suitable directory on the Web server host for storing the keyring filereferenced by the plug-in and associated files; for example: /ssl.2. Launch the IBM ikeyman tool that ships as part of GSKit and supports theCMS key database format. This version of the ikeyman tool comes with theIBM HTTP Server. Note that it is not the version of ikeyman that comes withthe WebSphere Application Server V5.3. From the ikeyman menu, select Key Database File -> New.4. Set the following settings then click OK when you are done:Key database file: CMS Key Database FileFile name: WASplugin.kdbLocation: c:\IBMHttpServer\conf\keys\ (or the directory of you choice)5. At the password prompt, enter the password of your choice; for our examplewe used password. Select the Stash the password to File box, and thepassword will be saved to the stash file so that the plug-in can use thepassword to gain access to the certificates contained in the key database.6. As we are only going to be implementing a peer-to-peer SSL connectionbetween the Web server plug-in and the embedded HTTP server of any givenWeb container, we are not concerned with the signer certificates of theChapter 10. Administering WebSphere security 303