+

Search Tips   |   Advanced Search

 

Configure trust anchors using the console

 

Use the WAS console to configure trust anchors that specify key stores which contain trusted root certificates to validate the signer certificate.

There is an important distinction between Version 5.x and V6 and later applications. The information in this article supports V5.x applications only that are used with WebSphere Application Server V6.0.x and later. The information does not apply to V6.0.x and later applications.

This document describes how to configure trust anchors or trust stores at the application level. It does not describe how to configure trust anchors at the server or cell level. Trust anchors defined at the application level have a higher precedence over trust anchors defined at the server or cell level. For more information on creating and configuring trust anchors at the server or cell level, see either Configure the server security bindings using an assembly tool or Configuring the server security bindings using the console.

You can configure an application-level trust anchor using an assembly tool or the console. This document describes how to configure the application-level trust anchor using the administrative console.

 

Overview

A trust anchor specifies key stores that contain trusted root certificates, which validate the signer certificate. These key stores are used by the request receiver (as defined in the ibm-webservices-bnd.xmi file) and the response receiver (as defined in the ibm-webservicesclient-bnd.xmi file when Web services is acting as client) to validate the signer certificate of the digital signature. The keystores are critical to the integrity of the digital signature validation. If they are tampered with, the result of the digital signature verification is doubtful and comprised. Therefore, it is recommended that you secure these keystores. The binding configuration specified for the request receiver in the ibm-webservices-bnd.xmi file must match the binding configuration for the response receiver in the ibm-webservicesclient-bnd.xmi file.

The following steps are for the client-side response receiver, which is defined in the ibm-webservicesclient-bnd.xmi file and the server-side request receiver, which is defined in the ibm-webservices-bnd.xmi file.

 

Procedure

  1. Configure an assembly tool to work with a Java 2 Platform, Enterprise Edition (J2EE) enterprise application. For more information, see Assembling applications

  2. Create a Web services-enabled J2EE enterprise application. See either Configure the server security bindings using an assembly tool or Configuring the server security bindings using the console for an introduction on how to manage Web services security binding information on the server.

  3. Click Applications > Enterprise applications > enterprise_application.

  4. Under Manage modules, click URI_name.

  5. Under Web Services Security Properties, click Web services: client security bindings to edit the response receiver binding information, if Web services is acting as a client.

    1. Under Response receiver binding, click Edit.

    2. Under Additional properties, click Trust anchors.

    3. Click New to create a new trust anchor.

    4. Enter a unique name within the request receiver binding for the Trust anchor name field. The name is used to reference the trust anchor that is defined.

    5. Enter the key store password, path, and key store type.

    6. Click the trust anchor name link to edit the selected trust anchor.

    7. Click Remove to remove the selected trust anchor or anchors.

      When you start the application, the configuration is validated in the run time while the binding information is loading.

  6. Return to the Web services-enabled module panel accessed in step 2.

  7. Under Web Services Security Properties, click Web services: server security bindings to edit the request receiver binding information.

    1. Under Request receiver binding, click Edit.

    2. Under Additional properties, click Trust anchors.

    3. Click New to create a new trust anchor

      Enter a unique name within the request receiver binding for the Trust anchor name field. The name is used to reference the trust anchor that is defined.

      Enter the key store password, path, and key store type.

      Click the trust anchor name link to edit the selected trust anchor.

      Click Remove to remove the selected trust anchor or anchors.

      When you start the application, the configuration is validated in the run time while the binding information is loading.

  8. Save the changes.

 

Results

This procedure defines trust anchors that can be used by the request receiver or the response receiver (if the Web services is acting as client) to verify the signer certificate.

 

Example

The request receiver or the response receiver (if the Web service is acting as a client) uses the defined trust anchor to verify the signer certificate. The trust anchor is referenced using the trust anchor name.

 

What to do next

To complete the signing information configuration process for request receiver, complete the following tasks:

  1. Configure the server for request digital signature verification: Verifying the message parts

  2. Configure the server for request digital signature verification: choosing the verification method

To complete the process for the response receiver, if the Web services is acting as client, complete the following tasks:

  1. Configure the client for response digital signature verification: verifying the message parts

  2. Configure the client for response digital signature verification: choosing the verification method


 

Related concepts


Trust anchors

 

Related tasks


Configure the server security bindings using an assembly tool
Configure the server security bindings using the console
Configure the server for request digital signature verification: Verifying the message parts
Configure the server for request digital signature verification: choosing the verification method
Configure the client for response digital signature verification: verifying the message parts
Configure the client for response digital signature verification: choosing the verification method
Securing Web services for V5.x applications using XML digital signature