Configuring trust anchors for the consumer binding on the application level

This document describes how to configure trust anchors for the consumer binding at the application level. It does not describe how to configure trust anchors at the server or cell level. Trust anchors that are defined at the application level have a higher precedence over trust anchors that are defined at the server or cell level. For more information on creating and configuring trust anchors on the server or cell level, see Configuring trust anchors on the server or cell level.

You can configure a trust anchor for the consumer binding using an assembly tool or the WebSphere® Application Server administrative console. This document describes how to configure the application-level trust anchor using the WAS administrative console.

A trust anchor specifies key stores that contain trusted root Certificate Authority (CA) certificates, which validate the signer certificate. These keystores are used by the request consumer (as defined in the ibm-webservices-bnd.xmi file) and the response consumer (as defined in the ibm-webservicesclient-bnd.xmi file when a Web service is acting as a client) to validate the X.509 certificate in the Simple Object Access protocol (SOAP) message. The keystores are critical to the integrity of the digital signature validation. If the keystores are tampered with, the result of the digital signature verification is doubtful and compromised. Therefore, it is recommended that you secure these keystores. The binding configuration specified for the request consumer in the ibm-webservices-bnd.xmi file must match the binding configuration for the response consumer in the ibm-webservicesclient-bnd.xmi file. The trust anchor configuration for the request consumer on the server side must match the request generator configuration on the client side. Also, the trust anchor configuration for the response consumer on the client side must match the response generator configuration on the server side.

Complete the following steps to configure trust anchors for the consumer binding on the application level:

1. Locate the trust anchor panel in the WAS administrative console.

   1. Click Applications > Enterprise applications > application_name.

   2. Under Related Items, click EJB Modules or Web Modules > URI_name.

   3. Under Additional properties you can access the trust anchor configuration for the following bindings:

      • For the request consumer (receiver) binding, click Web services: Server security bindings. Under Request consumer (receiver) binding, click Edit custom.

      • For the response consumer (receiver) binding, click Web services: Client security bindings. Under Response consumer (receiver) binding, click Edit custom.

   4. Under Additional properties, click Trust anchors.

   5. Click New to create a trust anchor configuration. Select the box next to a configuration and click Delete to delete an existing configuration or click the name of an existing trust anchor configuration to edit its settings. If you are creating a new configuration, enter a unique name in the Trust anchor name field.

2. Specify the keystore password, the keystore location, and the keystore type. A trust anchor keystore file contains the trusted root Certificate Authority (CA) certificates that are used for validating the X.509 certificate that is used in digital signature or XML encryption.

   1. Specify a password in the Key store password field. This password is used to access the keystore file.

   2. Specify the location of the keystore file in the Key store path field.

   3. Select a keystore type from the Key store type field. The Java™ Cryptography Extension (JCE) that is used by IBM® supports the following keystore types:

      JKS

      Use this option if you are not using Java Cryptography Extensions (JCE) and if your keystore file uses the Java Keystore (JKS) format.

      JCEKS

      Use this option if you are using Java Cryptography Extensions.

      PKCS11KS (PKCS11)

      Use this format if your keystore file uses the PKCS#11 file format. Keystore files that use this format might contain RSA keys on cryptographic hardware or might encrypt keys that use cryptographic hardware to ensure protection.

      PKCS12KS (PKCS12)

      Use this option if your keystore file uses the PKCS#12 file format.

      WAS provides some sample keystore files in the ${USER_INSTALL_ROOT}/etc/ws-security/samples directory. For example, you might use the enc-receiver.jceks keystore file for encryption keys. The password for this file is storepass and the type is JCEKS.

      Attention: Do not use these keystore files in a production environment. These samples are provided for testing purposes only.

This task configures trust anchors for the consumer binding at the application level

You must specify a similar trust anchor information for the generator.

 

Related tasks

Configuring trust anchors for the generator binding on the application level

Configuring trust anchors on the server or cell level

 

Related reference

Trust anchor collection

Trust anchor configuration settings

---