Change the signer auto-exchange prompt at the client
For clients to communicate with WebSphere Application Server, clients must obtain a signer certificate from the server. Clients can use the retrieveSigners command to connect to a server to obtain the appropriate signer. A prompt displays that asks whether or not we want to add a signer to the truststore. If the SSL configuration uses an automated script that might hang, use the prompt to obtain the certificate.
The com.ibm.ssl.enableSignerExchangePrompt property in the profile_home/properties/ssl.client.props file controls the signer certificate prompt. By default, this property is set to true, meaning the prompt is enabled.
Disable or enable the signer-exchange prompt at the client
- Edit profile_home/properties/ssl.client.props
- Locate the section containing the SSL configuration information for the client that we are working with.
- Change the value of the com.ibm.ssl.enableSignerExchangePrompt property to false if we do not want the signer-exchange prompt, or set it to true to be prompted.
- Save and close the file.
When the com.ibm.ssl.enableSignerExchangePrompt property is set to false, no prompt displays if a signer is not trusted. In this case the SSL handshake fails. Once the proper signer for the connection being made is manually installed in the trust store, the SSL handshake can succeed.
When the com.ibm.ssl.enableSignerExchangePrompt property is set to gui or true, a signer-exchange window is displayed, and we are asked to accept or reject the certificate. If we accept the certificate, it is installed in the trust store automatically and the handshake succeeds. If we reject the certificate, it does not get installed in the trust store and the handshake fails since the certificate is not trusted.
When the com.ibm.ssl.enableSignerExchangePrompt property is set to stdin, a signer-exchange ASCII prompt is displayed, and we are asked to accept or reject the certificate. If we accept the certificate, it is installed in the trust store automatically and the handshake succeeds. If we reject the certificate, it does not get installed in the trust store and the handshake fails since the certificate is not trusted.
The prompt looks like the following example:
Example
(Dist) (ZOS)C:\WebSphere\AppServer\profiles\dmgr\bin>serverStatus -all
ADMU0116I: Tool information is being logged in file C:\WebSphere\AppServer\profiles\Dmgr\logs\serverStatus.log
ADMU0128I: Starting tool with the dmgr profile
ADMU0503I: Retrieving server status for all servers
ADMU0505I: Servers found in configuration:
ADMU0506I: Server name: dmgr
*** SSL SIGNER EXCHANGE PROMPT ***
SSL signer from target host 192.174.1.5 is not found in truststore
C:/WebSphere/AppServer/profiles/Dmgr/etc/trust.p12.Verify that the digest value matches what is displayed at the server in the following signer information:
Subject DN: CN=hostname.austin.ibm.com, O=IBM, C=US
Issuer DN: CN=hostname.austin.ibm.com, O=IBM, C=US
Serial number: 1128544457
Expires: Thu Oct 20 15:34:17 CDT 2006
SHA-1 Digest: 91:A1:A9:2D:F2:7D:70:0F:04:06:73:A3:B4:A4:9C:56:9D:A8:A3:BA
D5 Digest: 88:72:C5:88:00:1C:A7:FA:D6:EB:04:88:AC:A1:C9:13
Add signer to the truststore now? (y/n) y
A retry of the request might need to occur.
ADMU0508I: The Application Server "server1" is STARTED.
What to do next
Clients can instigate communications for various processes using signer certificates obtained from WAS.
Related:
Secure installation for client signer retrieval in SSL ssl.client.props client configuration file