WAS v8.5 > Secure applications > Secure web services > Secure web services > Administer Web Services Security > Administer message-level security for JAX-RPC web services > Configure Web Services Security using JAX-RPC at the platform level

Configure trust anchors for the consumer binding on the application level

We can configure trust anchors for the consumer binding at the application level. This article does not describe how to configure trust anchors at the server or cell level. Trust anchors that are defined at the application level have a higher precedence over trust anchors that are defined at the server or cell level. For more information on creating and configuring trust anchors on the server or cell level, see Configure trust anchors on the server level.

We can configure a trust anchor at the application level using an assembly tool or the dmgr console. This article describes how to configure the application-level trust anchor using the dmgr console.

A trust anchor specifies key stores containing trusted root Certificate Authority (CA) certificates, which validate the signer certificate. These keystores are used by the request consumer (as defined in the ibm-webservices-bnd.xmi file) and the response consumer (as defined in the ibm-webservicesclient-bnd.xmi file when a web service is acting as a client) to validate the X.509 certificate in the SOAP message. The keystores are critical to the integrity of the digital signature validation. If the keystores are tampered with, the result of the digital signature verification is doubtful and comprised. Therefore, IBM recommends that you secure these keystores. The binding configuration specified for the request consumer in the ibm-webservices-bnd.xmi file must match the binding configuration for the response consumer in the ibm-webservicesclient-bnd.xmi file. The trust anchor configuration for the request consumer on the server side must match the request generator configuration on the client side. Also, the trust anchor configuration for the response consumer on the client side must match the response generator configuration on the server side.

To configure trust anchors for the consumer binding on the application level:

1. Locate the trust anchor panel in the dmgr console.

   1. Click Applications > Application Types > WebSphere enterprise applications > application_name.

   2. Under Manage modules, click URI_name.

   3. Under Web Services Security Properties we can access the trust anchor configuration for the following bindings:

      • For the request consumer (receiver) binding, click Web services: Server security bindings. Under Request consumer (receiver) binding, click Edit custom.

      • For the response consumer (receiver) binding, click Web services: Client security bindings. Under Response consumer (receiver) binding, click Edit custom.

   4. Under Additional properties, click Trust anchors.

   5. Click one of the following to work with trust anchor configuration:

      New

      To create a trust anchor configuration. Enter a unique name in the Trust anchor name field.

      Delete

      To delete the existing configuration selected in the box next to the configuration.

      an existing trust anchor configuration

      To edit the settings of an existing trust anchor configuration.

2. Specify the keystore password, the keystore location, and the keystore type. A trust anchor keystore file contains the trusted root Certificate Authority (CA) certificates used for validating the X.509 certificate used in digital signature or XML encryption.

   1. Specify a password in the Key store password field. This password is used to access the keystore file.

   2. Specify the location of the keystore file in the Key store path field.

   3. Select a keystore type from the Key store type field. The Java Cryptography Extension (JCE) used by IBM supports the following keystore types:

      JKS

      Use this option if you are not using Java Cryptography Extensions (JCE) and if the keystore file uses the Java Keystore (JKS) format.

      JCEKS

      Use this option if you are using Java Cryptography Extensions.

      PKCS11KS (PKCS11)

      Use this format if the keystore file uses the PKCS#11 file format. Keystore files that use this format might contain RSA keys on cryptographic hardware or might encrypt keys that use cryptographic hardware to ensure protection.

      PKCS12KS (PKCS12)

      Use this option if the keystore file uses the PKCS#12 file format.

      WebSphere Application Server provides some sample keystore files in the following directory, using the USER_INSTALL_ROOT variable: c:\{USER_INSTALL_ROOT}\etc\ws-security\samples${USER_INSTALL_ROOT}/etc/ws-security/samples

      For example, you might use the enc-receiver.jceks keystore file for encryption keys. The password for this file is storepass and the type is JCEKS.

      Restriction: Do not use these keystore files in a production environment. These samples are provided for testing purposes only.

Results

You have configured trust anchors for the consumer binding at the application level.

Specify a similar trust anchor information for the generator.

Related

Configure trust anchors for the generator binding on the application level
Configure trust anchors on the server level

Reference:

Trust anchor page
Trust anchor configuration settings

+

Search Tips   |   Advanced Search