Administer certificate authority clients

Use this topic to modify certificate authority (CA) client objects. The client object contains all of the configuration information necessary to connect to the third-party CA server.

We must configure a CA client object in the environment.

For existing CA client objects, use the steps in this topic to view, modify, or delete existing CA client object configurations.

• View existing CA client objects and configuration data. Use the listCAClients and getCAClient commands to query your environment for the existing CA clients.

  1. Launch the wsadmin scripting tool using the Jython scripting language. See the Starting the wsadmin scripting client article for more information.

  2. List all CA client objects in the configuration.

     Use the listCAClients command to list all certificate authority clients in the configuration. If we do not provide a value for the -scopeName parameter, then the command queries the cell if you use a dmgr profile or queries the node if you use an application server profile. Use the -all parameter to query the environment without using a specific scope:

     print AdminTask.listCAClients('-all true')

     The command returns an array of attribute lists, displaying one attribute list for each CA client, as the following example output displays:

     '[ [backupCAs ] [managementScope (cells/myCell01|security.xml#ManagementScope_1)
     ] [scopeName (cell):myCell01] [name jenCAClient] [baseDn ] [_Websphere_Config_Da
     ta_Id cells/myCell01|security.xml#CAClient_1181834566881] [port 2950] [CACertifi
     cate ] [pkiClientImplClass com.ibm.wsspi.ssl.WSPKIClient] [userId ] [_Webspher
     e_Config_Data_Type CAClient] [retryCheck 0] [properties ] [frequencyCheck 0] [pa
     ssword ] [host ] ]'
     '[ [backupCAs ] [managementScope (cells/myCell01|security.xml#ManagementScope_1)
     ] [scopeName (cell):myCell01] [name myCAClient] [baseDn ] [_Websphere_Config_Dat
     a_Id cells/myCell01|security.xml#CAClient_1181834566882] [port 2951] [CACertific
     ate ] [pkiClientImplClass com.ibm.wsspi.ssl.WSPKIClient] [userId ] [_Websphere
     _Config_Data_Type CAClient] [retryCheck 0] [properties ] [frequencyCheck 0] [pas
     sword ] [host ] ]'

  3. List the configuration attributes for a specific CA client.

     Use the getCAClient command to view the list of attributes for a specific CA client:

     print AdminTask.getCAClient('-caClientName myCAClient')

     The command returns an attribute list containing the attribute and value pairs for the specific CA client:

     '[ [backupCAs ] [managementScope (cells/myCell01|security.xml#ManagementSc
     ope_1)] [scopeName (cell):myCell01] [name myCAClient] [baseDn ] [_Websphe
     re_Config_Data_Id cells/myCell01|security.xml#CAClient_1181834566882] [por
     t 2951] [CACertificate ] [pkiClientImplClass com.ibm.wsspi.ssl.WSPKIClient] [u
     serId ] [_Websphere_Config_Data_Type CAClient] [retryCheck 0] [properties ] [fre
     quencyCheck 0] [password ] [host ] ]'

• Modify the existing CA client object configuration data. Use the modifyCAClient command to change one or more configuration attributes for a specific CA client.

  1. Start the wsadmin scripting tool.
     

  2. Determine which configuration attributes to edit.

     The modifyCAClient modifies all attributes specified with the command parameters. If we do not specify a parameter, then its corresponding attribute does not change.

     Parameter	Description	Data Type
     -scopeName	Specify the management scope of the CA client. For a dmgr profile, the system uses the cell scope as the default. For an application server profile, the system uses the node scope as the default.	String
     -pkiClientImplClass	Specify the class path that implements the WSPKIClient interface. The system uses this path to connect to the CA and to issue requests to the CA.	String
     -host	Specify the host name in the system where the CA resides.	String
     -port	Specify the port on the server where the CA listens.	String
     -userName	Specify the user name to use to authenticate to the CA.	String
     -password	Specify the password for the user name that authenticates to the CA.	String
     -frequencyCheck	Specify how often, in minutes, the system should check with the CA to determine if a certificate has been created.	String
     -retryCheck	Specify the number of times to check with the CA to determine if a certificate has been created.	String
     -customProperties	Specifies a comma separated list of attribute and value (attribute=value) custom property pairs to modify on the CA Client object. We can create, modify, or remove properties. To remove a property specify attribute= attribute as equal to no value.	String

  3. Modify specific configuration attributes for a CA client object.

     Use the following example command to modify the port number of the CA, the user name, and password attributes for the myCAClient CA client object:

     AdminTask.modifyCAClient('[-caClientName myCAClient -port 4060 -userName admin
      -password password4admin -pkiClientImplClass com.ibm.wsspi.ssl.WSPKIClient]')

  4. Save the configuration changes.

     Use the following command example to save the configuration changes:

     AdminConfig.save()

• Remove a CA client object from the configuration. Use the deleteCAClient command to delete a CA client object from the configuration. The command does not delete the CA client object if the CA client to delete is referenced by a certificate object.

  1. Start the wsadmin scripting tool.
     

  2. Determine the CA client object to delete.

     Use the listCAClients command to list all certificate authority clients in the configuration. If we do not provide a value for the -scopeName parameter, then the command queries the cell if you use a dmgr profile or queries the node if you use an application server profile. Use the -all parameter to query the environment without using a specific scope:

     print AdminTask.listCAClients('-all true')

  3. Delete the CA client object of interest.

     Use the deleteCAClient command to delete the CA client object from your configuration. Use the -caClientName parameter to specify the CA client to delete. We can optionally specify the management scope of the CA client object with the scopeName parameter. The following example command removes the myCAClient CA client object:

     AdminTask.deleteCAClient('[-caClientName myCAClient]')

     If we receive an error message, then verify that the CA client object of interest exists in the configuration and that it is not referenced by a certificate object in the security configuration.

  4. Save the configuration changes.

     Use the following command example to save the configuration changes:

     AdminConfig.save()

Related tasks

Configure certificate authority client objects

Create certificate authority (CA) personal certificates

Start the wsadmin scripting client

CAClientCommands (AdminTask)

PersonalCertificateCommands (AdminTask)