Add a CA certificate, or the public part of a self-signed certificate, into a key repository on UNIX, Linux, and Windows

Follow this procedure to add a CA certificate or the public part of a self-signed certificate to the key repository.

If the certificate to add is in a certificate chain, you must also add all the certificates that are above it in the chain. You must add the certificates in strictly descending order starting from the root, followed by the CA certificate immediately below it in the chain, and so on.

Where the following instructions refer to a CA certificate, they also apply to the public part of a self-signed certificate.

Note: You must ensure that the certificate is in ASCII (UTF-8) or binary (DER) encoding, because IBM® Global Secure Toolkit (GSKit) does not support certificates with other types of encoding.


Use iKeyman

If you need to manage TLS certificates in a way that is FIPS compliant, use the runmqakm command. iKeyman does not provide a FIPS-compliant option.

Perform the following steps on the machine on which you want to add the CA certificate:

  1. Start the iKeyman GUI using the strmqikm command (on UNIX, Linux and Windows systems).
  2. From the Key Database File menu, click Open. The Open window opens.
  3. Click Key database type and select CMS (Certificate Management System).
  4. Click Browse to navigate to the directory that contains the key database files.
  5. Select the key database file to which you want to add the certificate, for example key.kdb.
  6. Click OK. The Password Prompt window opens.
  7. Type the password you set when you created the key database and click OK. The name of your key database file displays in the File Name field.
  8. In the Key database content field, select Signer Certificates.
  9. Click Add. The Add CA's Certificate from a File window opens.
  10. Type the certificate file name and location where the certificate is stored, or click Browse to select the name and location.
  11. Click OK. The Enter a Label window opens.
  12. In the Enter a Label window, type the name of the certificate.
  13. Click OK. The certificate is added to the key database.


Use the command line

Use the following commands to add a CA certificate using iKeycmd or runmqakm:

  • On UNIX, Linux and Windows, issue the following command: 
    runmqckm -cert -add -db filename -pw password -label label -file filename
        -format ascii
where: