It's all about the answers!

Ask a question
QuestionsTagsUsersBadges
Guidelines | FAQ
Follow this question
Question details

×6,113
×1,305

question asked: Dec 15 '14, 6:13 a.m.
question was seen: 4,568 times
last updated: Jan 30 '15, 3:25 a.m.

Related questions

How to configure CA- Signed Certificate in WAS for RAM

0
anoop mc (748●11●200●221) | asked Dec 15 '14, 6:13 a.m.
 Dear team,

We have a requirement for configuring CA- Signed Certificate in WAS for RAM.

ca_signed_cert


having discussed with our internal Identity management team we ran Ikeyman tool from E:\Program Files\IBM\WebSphere\AppServer\profiles\AppSrv01\bin  

In the IBM Key Management Utility, click on Key Database File and then New.
  1. Choose Key database type and select JKS. Give the keystore a name such as your_domain.jks.

  2. Click the Browse button. Go to C:\Program Files\IBM\WebSphere\AppServer\profiles\default\etc or to a different location where you want to store your keystore file.

    1. Click OK. Enter a password and click OK.
    2. Click Create then New Certificate Request to bring up the Create New Key and Certificate Request dialog.

    3. Type a Key Label, Common Name, Organization, Locality, State, and select a Country. Select 2048 for Key Size. 

  4. We have send ramqa1certreq.arm file to the CA authority and in return they have send me the below set of files
ca_retrn

My question is : How to get this imported into WAS and after that our end-users should be able to browse the RAM URL (https) with out accepting the certificate on each browser.


2 answers

Most liked answers ↑|Newest answers|Oldest answers

0
permanent link
Kevin Ramer (4.5k●9●186●201) | answered Dec 31 '14, 3:10 p.m.
The path I've always taken with WebSphere is [ you should likely start at #4 below ]

  1. Go to NodeDefaultKeystore under Keystores [ as you've done ]
  2. Click on Personal Certificate Requests / New fill out the form
  3. Send the CSR to the Certificate Authority.  You'll likely get back a Base64 encoded file.  Put that on your websphere machine somewhere
  4. Again on NodeDefaultKeystore / Personal Certificates click Receive from Certificate authority
  5. Provide the path name
  6. This should import your new certificate in the NodeDefaultKeyStore file.  Make sure it shows up there.
  7. Next go to SSL Configurations, Open NodeDefaultSSL settings
  8. Choose your CA signed certificate next to "Default server certificate alias"
  9. Save
This should put your new certificate into effect immediately ( the "Dynamically update the run time ..."  is likely checked  under SSL Certificate and key management section already )

0
permanent link
anoop mc (748●11●200●221) | answered Jan 30 '15, 3:25 a.m.
 Hi,

Finally I could get this working by getting a CSR certificate signed back from our identity management team.

Also by working with IBM Support engineer Dipak Shah was a great help. 

Here is the link to follow 
 1)     Create a new certificate request

http://www-01.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/tsec_sslcreateCArequest.html?cp=SSAW57_8.5.5%2F1-8-2-33-4-7

Navigate to the path where the file got created and send it to the Identity Management Team and get it signed back. We have tried using Internal certificate key 

Note: Make sure you point the file name under any drive with .cer extension.

2. Next step is to receive the SSL cert

http://www14.software.ibm.com/webapp/wsbroker/redirect?version=phil&product=was-nd-dist&topic=tsec_sslreceiveCAcert

3. Replace the old one with new one

http://www14.software.ibm.com/webapp/wsbroker/redirect?version=phil&product=was-nd-dist&topic=tsec_sslreplaceselfsigncert 

Based on the import we did on our QA enviornment it worked fine with us.




Your answer

Register or to post your answer.


Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.