Manage keys with the IKEYMAN graphical interface (Distributed systems)
This section describes topics on how to set up and use the key management utility (IKEYMAN) with IBM® HTTP Server. Using the graphical user interface, rather than the command line interface, is recommended.
Before you begin
Ensure that the required compat-libstdc++ package exists for your operating system architecture. For more information, see the installation and verification information for Linux packages.About this task
Global Security Kit (GSKit) certificate management tools are installed in the <ihsinst>/bin/ directory. These tools should only be run from the installation directory. Examples for the following commands should include the full directory path, such as <ihsinst>/bin/gskcmd.- gskver
- ikeyman
- gskcapicmd
- gskcmd
For IKEYMAN, we can run the following command in the installation directory to generate debug information.
<ihsinst>/bin/ikeyman -x
To have a secure network connection, create a key for secure network communications and receive a certificate from a certificate authority (CA) that is designated as a trusted CA on your server.
Procedure
- Start the Key Management utility user interface. Use IKEYMAN to create key databases, public and private key pairs, and certificate requests.
- Work with key databases. We can use one key database for all your key pairs and certificates, or create multiple databases.
- Change the database password. When you create a new key database, you specify a key database password, which protects the private key. The private key is the only key that can sign documents or decrypt messages that are encrypted with the public key. Changing the key database password frequently is a good practice.
- Create a new key pair and certificate request. You find key pairs and certificate requests stored in a key database.
- Import and export your key into another database or to a PKCS12 file. PKCS12 is a standard for securely storing private keys and certificates.
- List certificate authorities within a key database.
- Display certificate expiration date your key database by viewing the certificate information with the IKEYMAN Key Management utility GUI or using the gskcmd command.
- If you act as your own CA, we can use IKEYMAN to create self-signed certificates.
- Receive a signed certificate from a certificate authority. If you act as your own CA for a private Web network, you have the option to use the server CA utility to generate and issue signed certificates to clients and servers in your private network.
- Display default keys and certificate authorities within a key database.
- Store a certificate from a certificate authority (CA) that is not a trusted CA.
- Store the encrypted database password in a stash file.
- Use IKEYMAN to create key databases, public and private key pairs, and certificate requests.
- If you act as your own CA, we can use IKEYMAN to create self-signed certificates.
- If you act as your own CA for a private Web network, you have the option to use the server CA utility to generate and issue signed certificates to clients and servers in your private network.
For more information about the IKEYMAN utility, see the IKEYMAN User's Guide on the IHS Library page.
What to do next
You may experience a certificate problem when you open a certificate that has a key with a higher
level of cryptography than your policy files permit. We can optionally install unlimited strength
JCE policy files.
This section describes how to start the Key Management (IKEYMAN) utility.
This topic describes how to create a new key database and open an existing key database.
When you create a new key database, you specify a key database password, which protects the private key. The private key is the only key that can sign documents or decrypt messages that are encrypted with the public key. Changing the key database password frequently is a good practice.
You find key pairs and certificate requests stored in a key database. This section provides information on how to create a key pair and certificate request.
This article describes how to import and export your key into another database or to a PKCS12 file. PKCS12 is a standard for securely storing private keys and certificates.
We can display a list of trusted certificate authorities within a key database.
We can display expiration dates of certificates in your key database by viewing the certificate information with the IKEYMAN Key Management utility GUI or using the gskcmd command.
It usually takes two to three weeks to get a certificate from a well known certificate authority (CA). While waiting for a certificate to be issued, use IKEYMAN to create a self-signed server certificate to enable SSL sessions between clients and the server. Use this procedure if you act as your own CA for a private Web network.
This topic describes how to receive an electronically mailed certificate from a certificate authority (CA), that is designated as a trusted CA on your server. A certificate authority is a trusted third-party organization or company that issues digital certificates used to create digital signatures and public-private key pairs.
This section describes how to view trusted certificate authorities and display default keys within a key database.
This topic describes how to store a certificate from a certificate authority (CA) that is not a trusted CA.
This section describes how you would store your database password in a stash file.
Related concepts
Related tasks