IBM WebSphere V5.0 Security - CGISecurity

and WebSphere” on page 302, and the difference here is that SSL betweenthe LDAP server and WebSphere. IBM Directory Server used the samekeystore type, KDB, that IBM HTTP Server uses.Extract the certificate from the Access Manager’s directory server ,IBMDirectory Server. During the installation we selected the default option for thekeystore; which means that the keystore can be found on the AccessManager server at C:\keytabs\pd_ldapkey.kdb. Use the password: gsk4ikmto open the keystore; and export the PDLDAP certificate from it.Save the certificate to the C:\keytabs\ldapcert.arm file.You can use the last steps from Section , “Generating a self-signed certificatefor the Web server plug-in” on page 303 for help.3. Import the extracted certificate into WebSphere’s server trust file, we wereusing the Dummy keyfile sets, so import the certificate into the\etc\DummyServerTrustFile.jks, the password isWebAS to open the Dummy keystore.Note: If you are not using the Dummy keystore for your LDAP SSLconnection, you will have to import the certificate into the Server Trust fileof your SSL entry that is used for secure LDAP connection. You canconfigure this for LDAP using the Administrative Console, under Security-> User Registries -> LDAP at the SSL Configuration field.The entry name when you import the certificate is: PDLDAP.You can use the last steps from Section , “Importing the certificate into theWeb Container keystore” on page 306 for help.4. Once the certificate is imported into WebSphere, the IBM Directory Servermust be configured in a way that it can use SSL with 128 bit encryption.Follow the steps from Section , “Configuring the IBM SecureWay DirectoryServer” on page 329 to do the configuration. The steps are the same for theIBM Directory Server as for the IBM SecureWay LDAP Directory.5. Stop and restart you WebSphere server. You are now using SSL tocommunicate between your WebSphere server and the directory server.Chapter 12. Tivoli Access Manager 385