IBM WebSphere V5.0 Security - CGISecurity

4. Select Signer Certificates in the drop-down list and click the Add button.This will allow you to import the public certificate previously extracted from theWeb server plug-in keyfile.Data type: Base64-encoded ASCII dataCertificate file name: WASpluginPubCert.armLocation: c:\WebSphere\Appserver\etc\Click OK when you are finished.5. You will be prompted for a label name by which the trusted signer publiccertificate will be known. Enter a label for the certificate: WASplugin.6. Close the key database and quit ikeyman when you are finished.Modifying the Web server plug-in fileThe plug-in config file must be modified to reference the plug-in keyring and thepassword stash file. This allows the transport protocol to be changed from HTTPto HTTPS, using the certificates stored in the keyring.A standard non-secure HTTP connection in the configuration looks like this:The same entry, but secured, looks like this:Note: the Transport XML tag has a body tag and a closing tag; make sure youremove the slash ‘/’ from the end of the opening tag.The transport protocol and SSL key properties can be specified for eachtransport. In the previous example, the simple HTTP transport had beensecured. However, this does not make much sense, since the communicationfrom the client to the Web server and the plug-in is not secured. The secure portfor the WebSphere Application Server 9433 is already defined in the plug-inconfiguration, and it is configured to use SSL/HTTPS.It might be useful for the production environment to replace the originalplugin-key.kdb file with your own key file for the secure transport definition, port9443.Chapter 10. Administering WebSphere security 307