+

Search Tips   |   Advanced Search

Set the collection certificate store for the generator binding on the application level


Configure a collection certificate for the generator bindings on the application level.

A collection certificate store is a collection of non-root, certificate authority (CA) certificates and certificate revocation lists (CRLs). This collection of CA certificates and CRLs is used to check for a valid signature in a digitally signed SOAP message.

Complete the following steps to configure a collection certificate for the generator bindings on the application level:

 

  1. Locate the collection certificate store configuration panel in the admin console.

    1. Click Applications > Application Types > WebSphere enterprise applications > application_name.

    2. Under Manage modules, click URI_name.

    3. Under WS-Security Properties, we can access the key information for the request generator and response generator bindings.

    4. Under Additional properties, click Collection certificate store.

  2. Specify the Certificate store name. Click New to create a collection certificate store configuration, select the box next to the configuration and click Delete to delete an existing configuration, .or click the name of an existing collection certificate store configuration to edit its settings. If creating a new configuration, enter a name in the Certificate store name field.

    The name of the collection certificate store must be unique to the level of the appserver. For example, if we create the collection certificate store for the application level, the store name must be unique to the application level. The name specified in the Certificate store name field is used by other configurations to refer to a predefined collection certificate store. WAS searches for the collection certificate store based on proximity.

    For example, if an application binding refers to a collection certificate store named cert1, the appserver searches for cert1 at the application level before searching the server level and then the cell level.

  3. Specify a certificate store provider in the Certificate store provider field. WAS supports the IBMCertPath certificate store provider. To use another certificate store provider, define the provider implementation in the provider list within the install_dir/java/jre/lib/security/java.security file. However, make sure that the provider supports the same requirements of the certificate path algorithm as WAS.

  4. Click OK and Save to save the configuration.

  5. Click the name of the certificate store configuration. After specify the certificate store provider, specify either the location of a certificate revocation list or the X.509 certificates. However, we can specify both a certificate revocation list and the X.509 certificates for your certificate store configuration.

  6. Under Additional properties, click Certificate revocation lists.

  7. Click New to specify a certificate revocation list path, click Delete to delete an existing list reference, or click the name of an existing reference to edit the path. Specify the fully qualified path to the location where WAS can find your list of certificates that are not valid. For portability reasons, it is recommended that you use the WAS variables to specify a relative path to the certificate revocation lists (CRL). This recommendation is especially important when we are working in a WAS ND environment. For example, we might use the USER_INSTALL_ROOT variable to define a path such as $USER_INSTALL_ROOT/mycertstore/mycrl1. For a list of supported variables, click Environment > WebSphere variables in the admin console.

    The following list provides recommendation for using certificate revocation lists:

    • If CRLs are added to the collection certificate store, add the CRLs for the root certificate authority and each intermediate certificate, if applicable. When the CRL is in the certificate collection store, the certificate revocation status for every certificate in the chain is checked against the CRL of the issuer.

    • When the CRL file is updated, the new CRL does not take effect until you restart the Web service application.

    • Before a CRL expires, load a new CRL into the certificate collection store to replace the old CRL. An expired CRL in the collection certificate store results in a certificate path (CertPath) build failure.

  8. Click OK and Save to save the configuration.

  9. Return to the collection certificate store configuration panel.

    To access the panel...

    1. Click Applications > Application Types > WebSphere enterprise apps > application_name.

    2. Under Manage modules, click URI_name.

    3. Under WS-Security properties, we can access the key information for the request generator and response generator bindings.

    4. Under Additional properties, click Collection certificate store > certificate_store_name.

  10. Under Additional properties, click X.509 certificates.

  11. Click New to create a X.509 certificate configuration, click Delete to delete an existing configuration, or click the name of an existing X.509 certificate configuration to edit its settings. If creating a new configuration, enter a name in the Certificate store name field.

  12. Specify a path in the X.509 certificate path field. This entry is the absolute path to the location of the X.509 certificate. The collection certificate store is used to validate the certificate path of incoming X.509-formatted security tokens.

    Use the USER_INSTALL_ROOT variable as part of path name. For example, we might type: USER_INSTALL_ROOT/etc/ws-security/samples/intca2.cer. Do not use this certificate path for production use. You must obtain our own X.509 certificate from a certificate authority before putting the WAS environment into production.

    Click Environment > WebSphere variables in the admin console to configure the USER_INSTALL_ROOT variable.

  13. Click OK and then Save to save the configuration.

 

Results

we have configured the collection certificate store for the generator binding.

 

Next steps

Specify a similar collection certificate store configuration for the consumer.


Collection certificate store collection
Collection certificate store settings
X.509 certificates collection
X.509 certificate settings
Certificate revocation list collection
Certificate revocation list settings

 

Related tasks


Set the collection certificate store for the consumer binding on the application level
Set WS-Security using JAX-RPC at the platform level