Using GSKit Tool and Certificate Process
for IHS-WebSphere
21/07/2009
Introduction
Key Terminologies
Prerequisites
WebSphere Certificate Creation
KeyStores for HIS
WebSphere Plugin
WebSphere Application Server
Exchange Signer Certificates
Maintenance
Gsk7cmd Options
Command To check if the certificates are expired
Conclusion
Linux/Unix
Hari Patnaik
hari.patnaik@tcs.com
Using GSKit Tool and Certificate Process for IHS-WebSphere
Introduction
The WebSphere infrastructure uses keystores to sign and encrypt the traffic flowing
between the components. The document describes the process to create the
certificates required, along with sections for creating each keystore type using
GSKit commands and some useful command related to certificates and key store.
GSKit stands for Global Security Kit. GSKit provides SSL (Secure Socket Layer)
functions for IBM Products and IKeyman (IBM Key Management Utility) GSKit
packagesWAS, IHS, Edge, MQ, Tivoli, etc.
Key Terminologies
• SSL (Secure Sockets Layer) is an encryption system used on servers to
ensure privacy when transmitting data across internet.
• Server needs a public-private key pair and a certificate. The server uses its
private key to sign messages to clients.
• To send its public key to clients, the server needs a certificate issued by a
certification authority (CA).
• A certification authority (CA) is a trusted third party that issues certificates.
• CMS- conversational monitor system (CMS)
• JKS Format: Java Key Store
• IHS: IBM Http Server a Webserver.
Prerequisites
IBM HttpServer, WebSphere 6.1 installed on Linux environment. Installing GSKit
should be a separate task, using the root user ID if SSL configuration is required
and no version of GSKit is installed, or if the installed version is down-level. Launch
the GSKit installation from the WebSphere Application Server CDROM as follows: –
On Linux and UNIX platforms: GSKit/gskit.sh
On Windows operating systems: GSKit\setup.exe IHS6.1
WebSphere Certificate Creation
A standard WebSphere set up consists of 3 products: IBM HTTP Server (IHS) for
receiving web traffic, WebSphere Application Server (WAS) to run the web
applications, and WebSphere Plugin to route the traffic from IHS to WAS. Each
component requires a keystore to be generated with specific requirements.
TCS Public
Using GSKit Tool and Certificate Process for IHS-WebSphere
Note:
I have used a common default install of GSKit on a linux environment located in
/usr/local/IBM/gsk7/. This should be replaced as appropriate if the path is different
on the server.
KeyStores for IHS
IHS requires a CMS-type keystore be created. By default, all IHS certificates must be
signed by an external Certificate Authority (CA).
Execute the following commands to create a CA-signed certificate in a CMS
keystore. The following section assumes the request is being sent to the CA-
Certificate Authority.
1. Execute the following commands to create a keystore and a certificate
request. Replace italicized values as appropriate:
export PATH=/opt/IBM/WebSphere/AppServer61/java/bin:
/usr/local/IBM/gsk7/bin: $PATH
this adds the correct path to be used by GSKit commands.
gsk7cmd -keydb -create -db <keystore>.kdb -pw <password> -stash
This generates set of files needed for the public and private Key generation.
gsk7cmd -certreq -create -db <keystore>.kdb -pw <password> -size 1024 -
dn "CN=dnslongname,O=Company,L=City,ST=State,C=Country" -label
dnsshortname -file dnsshortname.csr
This generates the raw certificate file which needs to be stamped by a
Certificate Authority(CA)
2. Complete a certificate request using the csr file and get it signed by CA.
3. The certificate authority can send more than one certificate. In addition to
the certificate for your server, the CA can also send additional signing
certificates or intermediate CA certificates. For example, Verisign includes
an intermediate CA certificate when sending a Global Server ID certificate.
Before receiving the server certificate, receive any additional intermediate
CA certificates. Follow the instructions in the Storing a CA certificate topic to
receive intermediate CA certificates.Obtain the Root CA and Intermediate
CA certificates, copy the files to the server in a temp directory, and execute
the following commands:
gsk7cmd -cert -add -db <keystore>.kdb -pw <password> -label RootCA -
format binary -file RootCA.cer
TCS Public
Using GSKit Tool and Certificate Process for IHS-WebSphere
gsk7cmd -cert -add -db <keystore>.kdb -pw <password> -label
IntermediateCA -format binary -file IntermediateCA.cer
4. Once the certificate request has been completed, copy the generated .cer
file (referred to as cert.cer below) as a binary DER to the server in a temp
directory and execute the following command:
gsk7cmd -cert -receive -file cert.cer -db <keystore>.kdb -pw <password> -
format binary -default_cert yes
5. Restart IHS web server for make the change effective.
WebSphere Plugin
WebSphere Plugin requires a CMS-type keystore be created. By default, all
WebSphere Plugin certificates are self-signed. Execute the following commands to
create a self-signed certificate in a CMS keystore. Replace values as appropriate:
export
PATH=/opt/IBM/WebSphere/AppServer61/java/bin:/usr/local/ibm/gsk7/bin:$PATH
gsk7cmd -keydb -create -db <keystore>.kdb -pw <password> -stash
gsk7cmd -cert -create -db <keystore>.kdb -pw <password> -size 1024 -dn
"CN=dnslongname,O=Company,L=City,ST=State,C=Country" -label dnsshortname
-expire 365 -default_cert yes
Please note, the name of the keystore must be plugin-key.kdb. You must also take
note of the name of the personal certificate created, as it will be used when
exchanging signer certificates with the WAS keystore.
WebSphere Application Server
WebSphere supports keystores in a number of formats, but I have used commonly
used JKS format. By default, all WebSphere Application Server certificates are self-
signed. Execute the following commands to create a self-signed certificate in a JKS
keystore. Replace italicized values as appropriate:
export
PATH=/opt/IBM/WebSphere/AppServer61/java/bin:/usr/local/ibm/gsk7/bin:$PATH
gsk7cmd -keydb -create -db <keystore>.jks -pw <password> -type jks
TCS Public
Using GSKit Tool and Certificate Process for IHS-WebSphere
gsk7cmd -cert -create -db <keystore>.jks -pw <password> -size 1024 -dn
"CN=dnsfullname,O=Company,L=City,ST=State,C=Country" -label servername -
expire 1825 -type jks
gsk7cmd -cert -extract -db <keystore>.jks -pw <password> -label servername -
target servername.cer -format binary –type jks
gsk7cmd -cert -add -db <keystore>.jks -pw <password> -label servernameKey -
format binary -file servername.cer –type jks
You must take note of the name of the personal certificate created, as it will be
used when exchanging signer certificates with the WAS keystore.
Exchange Signer Certificates
As both the Plugin and WAS certificates are self-signed, we must configure each
keystore to trust the other one. Execute the following commands to complete this.
1. Export the path in order to run GSKit commands:
export
PATH=/opt/IBM/WebSphere/AppServer61/java/bin:/usr/local/ibm/gsk7/bin:
$PATH
2. Export the personal certificate from the WAS JKS keystore:
gsk7cmd -cert -extract -db <keystore>.jks -pw <password> -label
servername -target servername.cer -format binary –type jks
3. Export the personal certificate from the Plugin CMS keystore:
gsk7cmd -cert -extract -db plugin-key.kdb -pw <password> -label
servername -target plugin.cer -format binary
4. Import the WAS personal certificate into the Plugin keystore:
gsk7cmd -cert -add -db plugin-key.kdb -pw <password> -label waskey -
format binary -file servername.cer
5. Import the Plugin personal certificate into the WAS keystore:
gsk7cmd -cert -add -db <keystore>.jks -pw <password> -label pluginkey -
format binary -file plugin.cer –type jks
TCS Public
Using GSKit Tool and Certificate Process for IHS-WebSphere
Your keystores are now ready to be distributed to the appropriate servers. Restart
all the components and you are all set.
Maintenance
Gsk7cmd Options:
The folloing options can be used for the gsk7cmd command
Object Action Description
---- ------ ---------------------------------------------------------
-keydb -changepw Change the password for a key database
-convert Convert the format of a key database
-create Create a key database
-delete Delete a key database
-stashpw Stash the password of a key database into a file
-list Currently supported types of key database.
-cert -add Add a CA Certificate
-create Create a self-signed certificate
-delete Delete a certificate
-details Show the details of a specific certificate
-export Export a personal certificate and associated private key
into a PKCS12 file or a key database
-extract Extract a certificate from a key database
-getdefault Show the default personal certificate
-import Import a certificate from a key database or a PKCS12 file
-list List certificates in a key database
-modify Modify a certificate (NOTE: the only field that my be
modified is the trust field)
-receive Receive a certificate
-setdefault Set the default personal certificate
-sign Sign a certificate
-certreq -create Create a certificate request
-delete Delete a certificate request from a certificate request
database
-details Show the details of a specific certificate request
-extract Extract a certificate from a certificate request database
-list List all certificate requests in a certificate request
database
-recreate Recreate a certificate request
-version Display ikeycmd version information
-help Display this help text
TCS Public
Using GSKit Tool and Certificate Process for IHS-WebSphere
Command To Check if the certificates are expired
1.$export
PATH=/opt/IBM/WebSphere/AppServer6/java/bin:/usr/local/ibm/gsk7/bin:$PATH
2.Command to check which java is getting used:
$which java
Out put:/opt/IBM/WebSphere/AppServer6/java/bin/java
3. $ gsk7cmd -cert -list -db ProdIHSkeys.kdb -pw passw0rd$
Out put:
Certificates in database: ProdIHSkeys.kdb
RootCA
Entrust.net Global Secure Server Certification Authority
*********************************
VeriSign Class 3 Public Primary Certification Authority
*******************************
Thawte Personal Premium CA
*******************************
RSA Secure Server Certification Authority
ALIASNAME
*******************************
4. $gsk7cmd -cert -details -label ALIASNAME -db ProdIHSkeys.kdb -pw passw0rd$
Out Put:
Label: ALIASNAME
Key Size: 1024
Version: *****
Serial Number:******************************
Issued By: *******************
Address
Subject: DNSLONGNAME OF THE SITE
Company
Address
Valid From: <Date and Time> To: <Date and Time>
Fingerprint: ****************************************
Signature Algorithm: *****************
Trust Status: enabled
Interested areas are DNSLONGNAME OF THE SITE which is customerfacing Url
and the expiry date of the certificate. If the certificate is expired you need to follow
the above steps.
TCS Public
Using GSKit Tool and Certificate Process for IHS-WebSphere
Conclusion
In e business world most of the transactions where customer data needs to be secured
are achieved though SSL encryption system used on servers ensuring privacy
transmitting data across internet. They use public-private key pair and a certificate to
execute. The server uses its private key to sign messages to clients.To send its public
key to clients, the server needs a certificate issued by a certification authority (CA)
ex: veriSign etc. Then the customer reads the certificate through ViewCertificate and
may/may not wish to transmit their data by clicking yes/no on the Certificate which
gets popped up to the customer.IHS/Websphere pays key roles on enterprise
applications and Gskit like tools helps facilitate the process.
TCS Public
