Secure > Enhance site security


Enable SSL for outbound Web services

You can enable SSL for Web services created using WebSphere Commerce Web services or Rational Application Developer. If you require additional security measures, you should consider alternatives such as creating JAX-WS/JAX-RPC Web service clients using the Rational Application Developer wizard.

If using the Rational Application Developer wizard, the client should be created under an EJB project using a stateless session bean facade to access the service, not in the Stores.war project. That is, if you define the Web Service client in the Stores Web Module, the service reference will not be visible if you are running outside the Stores context. For example, if you attempt to use the Web Service Client from a scheduler job, the call will fail.

For further reference, see the following IBM Redbooks:


Before you begin

Ensure that you have completed the following task:


Procedure

  1. When client authentication is not required.

    If the server does not require client authentication, that is, it does not validate the client certificate, the configuration is not complex. The server certificate is added to the default Trust Store:

    1. Open the WAS Administrative Console.

    2. Under Security, navigate to SSL certificate and key managementKey stores and certificates.

    3. Select NodeDefaultTrustStore.

    4. Under Additional Properties, click Signer Certificates.

    5. You can either:

      • Click Retrieve from port and enter the HTTPS hostname and port. This automatically retrieves the certificate for you.

      • Click Add to import the Base64-encoded certificate file.

      The server is now trusted.

  2. When client authentication is required.

    If client authentication is required, the server verifies the client certificate and refuses the connection if the client is untrusted. The server must add the client certificate to its own trust store.

    1. Create the key and trust stores.

      For testing purposes, you can create a new key and trust store and use a self-signed certificate. However, in production, use a certificate from a trusted certificate authority.

      1. Open ikeyman to create the certificate stores. ikeyman is located in the AppServer/bin directory.

      2. In the Key Database File menu, select New....

        1. For the key database type, select JKS. Other formats such as PKCS12 can also be selected.

        2. Select a name and path for the KeyStore. For example, CommerceKeyStore.jks

        3. Enter a password. It is important that you remember this password as it will be needed in later steps.

      3. When Personal Certificates is selected, click New Self-Signed...

      4. Complete the form and click Accept.
      You have created a new Key store which contains the self-signed certificate. The following steps create the trust store.

      1. In the Key Database File menu, select New....

        1. Create a new file which will be used for the trust store, for example, CommerceTrustStore.jks. The trust store contains the certificates this server trusts. The server certificate will need to be added to this trust store.

        2. The server certificate can be added later using the user interface but you can also do it with ikeyman. The server certificate will typically be a .arm (Base64-encoded) certificate file or be included in a key database such as jks or p12.

        3. To import the server certificate from an arm file, ensure the Signer Certificates drop-down is selected and click Add.... If the certificate is an jks/p12 file you can extract it as an asm file.

    2. Define the new Trust and Key stores in WebSphere Commerce.

      1. Open the WAS Administrative Console.

      2. Under Security, navigate to SSL certificate and key managementKey stores and certificates.

      3. Click New. Use CommerceKeyStore for the name and populate the path and password for the CommerceKeyStore.jks file and remaining options.

      4. After creation, click Personal certificates to see the details of the self signed certificate. This test ensures the key store is correctly defined.

      5. Repeat these steps and define CommerceTrustStore from CommerceTrustStore.jks. Click Signer certificates for the trust store to see the server certificate.

    3. Create a new SSL configuration.

      1. Under Security, navigate to SSL certificate and key managementKey stores and certificates and click New.

      2. Enter CommerceSSLConfig as the name.

      3. For the Trust store name, select CommerceTrustStore.

      4. For the Key store name, select CommerceKeyStore.

      5. Click Get certificate aliases.

      6. For the Default server certificate alias and Default client certificate alias, select the alias for the self-signed certificate or the client certificate.

      7. Under Additional properties, click Quality of protection (QoP) settings.

      8. Set Client Authentication to Required.

    4. Associate the SSL Configuration to the Web Service.

      1. Under SSL certificate and key management, click Dynamic outbound endpoint SSL configurations and click New. On this page, you can configure outbound requests made in a particular protocol to a particular hostname and port to use a non-default SSL configuration.

      2. Select the combination of protocol, host and port that matches the one used by the outbound Web service.

      3. Under SSL Configuration select CommerceSSLConfig and click Get certificate aliases.

      4. Select the client certificate.


+

Search Tips   |   Advanced Search