Configure trust anchors for the generator binding on the application level

A trust anchor specifies keystores containing trusted root certificates, which validate the signer certificate. These keystores are used by the request generator and the response generator (when web services are acting as client) to generate the signer certificate for the digital signature. We can configure trust anchors for the generator binding at the application level using the console.

We can configure a trust anchor using an assembly tool or the console. This task describes how to configure the application-level trust anchor using the console. For more information on assembly tools, see the related information.

The keystores are critical to the integrity of the digital signature validation. If they are tampered with, the result of the digital signature verification is doubtful and comprised. Therefore, IBM recommends that you secure these keystores. The binding configuration specified for the request generator must match the binding configuration for the response generator.

The trust anchor configuration for the request generator on the client must match the configuration for the request consumer on the server. Also, the trust anchor configuration for the response generator on the server must match the configuration for the response consumer on the client.

Trust anchors defined at the application level have a higher precedence over trust anchors defined at the server or cell level. How to configure trust anchors at the server or cell level is not described in this task. For more information on creating and configuring trust anchors on the server or cell level, see Configure trust anchors on the server or cell level.

Complete the following steps to configure trust anchors for the generator binding on the application level:

1. Locate the trust anchor panel in the console.

   1. Click Applications > Application Types > WebSphere enterprise applications > application_name.

   2. Under Manage modules, click URI_name.

   3. Under Web Services Security Properties we can access the trust anchor configuration for the following bindings:

      • For the request generator (sender) binding, click Web services: Client security bindings. Under Request generator (sender) binding, click Edit custom.

      • For the response generator (sender) binding, click Web services: Server security bindings. Under Response generator (sender) binding, click Edit custom.

   4. Under Additional properties, click Trust anchors.

   5. Click New to create a trust anchor configuration, click Delete to delete an existing configuration, or click the name of an existing trust anchor configuration to edit its settings. For a new configuration, enter a unique name in the Trust anchor name field.

2. Specify the keystore password, the keystore location, and the keystore type. keystore files contain public and private keys, root certificate authority (CA) certificates, the intermediate CA certificate, and so on. Keys retrieved from the keystore are used to sign and validate or encrypt and decrypt messages or message parts. If we specified the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator implementation for the key locator class implementation, specify a keystore password, location, and type.

   1. Specify a password in the Keystore password field. This password is used to access the keystore file.

   2. Specify the location of the keystore file in the Keystore path field.

   3. Select a keystore type from the Keystore type field. The Java Cryptography Extension (JCE) used by IBM supports the following keystore types:

      JKS

      Use this option if you are not using Java Cryptography Extensions (JCE) and if the keystore file uses the Java Keystore (JKS) format.

      JCEKS

      Use this option if you are using Java Cryptography Extensions.

      (zos) JCERACFKS

      Use JCERACFKS if the certificates are stored in a SAF key ring (z/OS only).

      PKCS11KS (PKCS11)

      Use this format if the keystore uses the PKCS#11 file format. Keystores using this format might contain RSA keys on cryptographic hardware or might encrypt keys that use cryptographic hardware to ensure protection.

      PKCS12KS (PKCS12)

      Use this option if the keystore uses the PKCS#12 file format.

      WebSphere Application Server provides some sample keystore files in the following directory, using the USER_INSTALL_ROOT variable: c:\{USER_INSTALL_ROOT}\etc\ws-security\samples${USER_INSTALL_ROOT}/etc/ws-security/samples

      For example, you might use the enc-receiver.jceks keystore file for encryption keys. The password for this file is Storepass and the type is JCEKS.

      Restriction: Do not use these keystore files in a production environment. These samples are provided for testing purposes only.

Results

This task configures trust anchors for the generator binding at the application level.

What to do next

Specify a similar trust anchor configuration for the consumer.

Subtopics

• Trust anchor collection
  Use this page to view a list of keystore objects containing trusted root certificates. These objects are used for certificate path validation of incoming X.509-formatted security tokens. Keystore objects within trust anchors contain trusted root certificates used by the CertPath API to validate the trust of a certificate chain.

• Trust anchor configuration settings
  Use this information to configure a trust anchor. Trust anchors point to keystores containing trusted root or self-signed certificates. This information enables you to specify a name for the trust anchor and the information needed to access a keystore. The application binding uses this name to reference a predefined trust anchor definition in the binding file (or the default).

Related concepts

Development and assembly tools