IBM WebSphere V5.0 Security - CGISecurity

Exchanging public certificatesThe following two sections will describe how to exchange certificates betweenthe Web Container keystore and the Web server plug-in keyfile.In order to import the certificates into the keystores as described in the next twosections, you will have to copy over the two certificates and the extracted .armfiles to both machines, the Web server, and the WebSphere server.1. Copy WASpluginPubCert.arm from the Web server machine to theWebSphere machine. The source directory in our case is c:\ihs\conf\keys,while the destination is: c:\WebSphere\Appserver\etc.2. Copy WASWebContainerPubCert.arm from the WebSphere machine to theWeb server machine. The source directory in our case is c:\was\etc, while thedestination is: c:\IBMHttpServer\conf\keys.Importing the certificate into the Web server plug-in keyfile1. On the Web server machine, launch the ikeyman utility that supports the CMSkey database format.2. From the ikeyman menu select Key Database File -> Open and select thepreviously created key database file: WASplugin.kdb.3. At the password prompt window, enter the password then click OK.4. Select Signer Certificates from the drop-down list, then click the Add button.This will allow you to import the public certificate previously extracted from theembedded HTTP server/Web Container keystore.Data type: Base64-encoded ASCII dataCertificate file name: WASWebContainerPubCert.armLocation: c:\WebSphere\Appserver\etc\Click OK when you are finished.5. You will be prompted for a label name by which the trusted signer publiccertificate will be known. Enter a label for the certificate: WASWebContainer.6. Close the key database and quit ikeyman when you are finished.Importing the certificate into the Web Container keystore1. On the WebSphere machine, launch the IBM JKS capable ikeyman versionthat ships under the WebSphere bin directory.2. From the ikeyman menu, select Key Database File -> Open and select thepreviously created WASWebContainer.jks file.3. At the password prompt, enter the password for the keyfile, then click OK.306 IBM WebSphere V5.0 Security Handbook