Manage digital certificates

 

This section tells you about managing the digital certificates in the key database file.

When you make changes to the certificates in a key database file, refer to When changes become effective.

Perform the following steps to work with the key database file:

  1. Execute the gsk6ikm command to start the iKeyman GUI.

  2. From the Key Database File menu, click Open. The Open window displays.

  3. Click Key database type and select CMS (Certificate Management System).

  4. Click Browse to navigate to the directory that contains the key database files.

  5. Select the key database file to which you want to add the certificate, for example key.kdb.

  6. Click Open. The Password Prompt window displays.

  7. Type the password you set when you created the key database and click OK. The name of the key database file displays in the File Name field.

 

Transferring certificates

This section tells you how to perform the following tasks:

 

Extracting a CA certificate from a key repository

Perform the following steps on the machine from which you want to extract the CA certificate:

  1. In the Key database content field, select Signer Certificates and select the certificate you want to extract.

  2. Click Extract. The Extract a Certificate to a File window displays.

  3. Select the Data type of the certificate, for example Base64-encoded ASCII data for a file with the .arm extension.

  4. Type the certificate file name and location where you want to store the certificate, or click Browse to select the name and location.

  5. Click OK. The certificate is written to the file you specified.

Use the following command to extract a CA certificate using IKEYCMD: 

gsk6cmd -cert -extract -db filename -pw password -label label -target filename
        -format ascii

where:

-db filename is the fully qualified path name of a CMS key database.
-pw password is the password for the CMS key database.
-label label is the label attached to the certificate.
-target filename is the name of the destination file.
-format ascii is the format of the certificate. The value can be ascii for Base64-encoded ASCII or binary for Binary DER data. The default is ascii.

 

Adding a CA certificate into a key repository

Perform the following steps on the machine to which you want to add the CA certificate:

  1. In the Key database content field, select Signer Certificates and select the certificate you want to add.

  2. Click Add. The Add CA's Certificate from a File window displays.

  3. Select the Data type of the certificate you transferred, for example Base64-encoded ASCII data for a file with the .arm extension.

  4. Type the certificate file name and location where the certificate is stored, or click Browse to select the name and location.

  5. Click OK. The Enter a Label window displays.

  6. In the Enter a Label window, type the name of the certificate.

  7. Click OK. The certificate is added to the key database.

Use the following command to add a CA certificate using IKEYCMD: 

gsk6cmd -cert -add -db filename -pw password -label label -file filename
        -format ascii

where:

-db filename is the fully qualified path name of the CMS key database.
-pw password is the password for the CMS key database.
-label label is the label attached to the certificate.
-file filename is the name of the file containing the certificate.
-format ascii is the format of the certificate. The value can be ascii for Base64-encoded ASCII or binary for Binary DER data. The default is ascii.

 

Exporting a personal certificate from a key repository

Perform the following steps on the machine from which you want to export the personal certificate:

  1. In the Key database content field, select Personal Certificates and select the certificate you want to export.

  2. Click Export/Import. The Export/Import key window displays.

  3. Select Export Key.

  4. Select the Key file type of the certificate you want to export, for example PKCS12.

  5. Type the file name and location to which you want to export the certificate, or click Browse to select the name and location.

  6. Click OK. The Password Prompt window displays.

  7. Type a password in the Password field, and type it again in the Confirm Password field.

  8. Click OK. The certificate is exported to the file you specified.

Use the following command to export a personal certificate using IKEYCMD: 

gsk6cmd -cert -export -db filename -pw password -label label -type cms
        -target filename -target_pw password -target_type pkcs12

where:

-db filename is the fully qualified path name of the CMS key database.
-pw password is the password for the CMS key database.
-label label is the label attached to the certificate.
-type cms is the type of the database.
-target filename is the name of the destination file.
-target_pw password is the password for encrypting the certificate.
-target_type pkcs12 is the type of the certificate.

 

Importing a personal certificate into a key repository

Notes:

  1. Before you import a personal certificate in PKCS #12 format into iKeyman, first import the corresponding CA certificates.

  2. You cannot import a personal certificate that has multiple OU attributes.

Perform the following steps on the machine to which you want to import the personal certificate:

  1. In the Key database content field, select Personal Certificates and select the certificate you want to import.

  2. Click Export/Import. The Export/Import key window displays.

  3. Select Import Key.

  4. Select the Key file type of the certificate you want to import, for example PKCS12.

  5. Type the certificate file name and location where the certificate is stored, or click Browse to select the name and location.

  6. Click OK. The Password Prompt window displays.

  7. In the Password field, type the password used when the certificate was exported.

  8. Click OK. The certificate is imported to the key database.

Use the following command to import a personal certificate using IKEYCMD: 

gsk6cmd -cert -import -file filename -pw password -type pkcs12 -target filename
        -target_pw password -target_type cms

where:

-file filename is the fully qualified path name of the file containing the PKCS #12 certificate.
-pw password is the password for the PKCS #12 certificate.
-type pkcs12 is the type of the file.
-target filename is the name of the destination CMS key database.
-target_pw password is the password for the CMS key database.
-target_type cms is the type of the database specified by -target

 

Removing certificates

Use the following procedure to remove personal certificates:

  1. In the Personal Certificates field, select the certificate labelled:

    • For a queue manager, ibmwebspheremq followed by the name of the queue manager folded to lower case. For example, for PARIS, ibmwebspheremqPARIS, or,

    • For a WebSphere MQ client, ibmwebspheremq followed by the logon user ID folded to lower case, for example ibmwebspheremqmyuserid.

  2. If you do not already have a copy of the certificate and you want to save it:

    1. Click Extract. The Extract a Certificate to a File window displays.

    2. Select the Data type of the new personal certificate, for example Base64-encoded ASCII data for a file with the .arm extension.

    3. Type the certificate file name and location where you want to store the certificate, or click Browse to select the name and location.

    4. Click OK. The certificate is written to the file you specified.

  3. With the certificate selected, click Delete. The Confirm window displays.

  4. Click Yes. The Personal Certificates field no longer shows the label of the certificate you deleted.

Use the following command to remove a certificate using IKEYCMD: 

gsk6cmd -cert -delete -db filename -pw password -label label

where:

-db filename is the fully qualified path name of a CMS key database.
-pw password is the password for the CMS key database.
-label label is the label attached to the certificate.

 

Editing a certificate label

When you import a personal certificate into iKeyman for use with WebSphere MQ, ensure that the Friendly name attribute is set to the correct value:

  • For a queue manager, ibmwebspheremq followed by the name of the queue manager folded to lower case. For example, for PARIS, ibmwebspheremqPARIS, or,

  • For a WebSphere MQ client, ibmwebspheremq followed by the logon user ID folded to lower case, for example ibmwebspheremqmyuserid.

Note:
The value of the attribute must be exact. When you receive the personal certificate from the Certification Authority and edit the Friendly name property, some browsers add extra characters, for example a carriage return. After editing, you might need to import the certificate into a different browser and export it before the import the certificate into iKeyman.

 

WebSphere is a trademark of the IBM Corporation in the United States, other countries, or both.

 

IBM is a trademark of the IBM Corporation in the United States, other countries, or both.