IBM WebSphere V5.0 Security - CGISecurity

e prompted for the keyfile password; if using the dummy file, this is WebAS.The IBM Key Management panel will then be displayed. Select PersonalCertificates, and the following panel will be displayed.2. We now need to extract our WebSphere certificate. Select the Webspheredummy server certificate, and then click the Export/Import... button. Thefollowing panel will then be displayed.3. For Data type, select Base64-encoded ASCII data. For Certificate file name,enter the file name for the certificate. In our example, we usedWebSphereServerCert.arm. In the Location field, enter the path to thedirectory you wish to store the certificate in. In our example, we stored thecertificate in etc directory of the WebSphere root. Once you have completedyour entries, click the OK button.4. Once you have saved your certificate, you will need to transfer it to yourWebSEAL server. Note that if you have defined your own keyfiles forWebSphere, and have obtained a certificate from a CA, that you can use theroot CA’s certificate which signed your WebSphere certificate in the followingsteps instead.5. To set up the trust relationship between WebSphere and WebSEAL, we nowneed to import the certificate just saved, or the signing root CA certificate forour WebSphere server. This will establish a trust relationship for WebSEAL.Note that if you wish to use mutual SSL authentication, you will also need tosetup the trust relationship for WebSphere in a similar matter.6. To begin, on your WebSEAL server, start the GSKIT GUI. Open yourWebSEAL key database. We are using the WebSEAL default database, andselected \www\certs\pdsrv.kdb. You will then beprompted for the key database password. The password for the defaultWebSEAL database is pdsrv. Once the database is opened, select SignerCertificates. The following panel will then be displayed.7. Select the Add... button. The following panel will then be displayed.8. For Data type, select Base64-encoded ASCII data. In the Certificate filename field, enter the name of the certificate. In our example, this isWebSphereServerCert.arm. In the Location field, enter the path to thedirectory that you have stored your certificate file. In our example, we entered\etc. Once you have finished your entries, select the OKbutton. You will then be prompted for a label name to store your certificatewith. Enter a name that will make it easy for you to identify that this certificateis for your WebSphere server. The IBM Key Management panel will then bedisplayed, and the certificate you just added will now be displayed as thelabel name you specified. You may now close the IBM Key Managementutility. We now have established the trust relationship for our WebSEALserver.400 IBM WebSphere V5.0 Security Handbook