CreateIHSPLUGINFORLIBERTYPROFILE < Deployment

r30 - 2023-12-18 - 09:45:07 - TrushankShahYou are here: TWiki >
Deployment Web > DeploymentInstallingUpgradingAndMigrating > CreateIHSPLUGINFORLIBERTYPROFILE
<div id="header-title" style="padding: 10px 15px; border-width:1px; border-style:solid; border-color:#FFD28C; background-image: url(<nop>https://jazz.net/wiki/pub/Deployment/WebPreferences/TLASE.jpg); background-size: cover; font-size:120%">
---+!! Creating The IHS Plugin for Liberty Profile<img src="https://jazz.net/wiki/pub/Deployment/WebPreferences/new.png" alt="new.png" width="50" height="50" align="right"> <br />  
%DKGRAY% Authors: Main.MikeDelargy, Main.BenSilverman, Main.RosaNaranjo, Main.BrianLahaie <br>
<br />

Build basis: 6.0.6.x - 7.0.2
%ENDCOLOR%</div></sticky>

<!-- Page contents top of page on right hand side in box -->
<sticky><div style="float:right; border-width:1px; border-style:solid; border-color:#DFDFDF; background-color:#F6F6F6; margin:0 0 15px 15px; padding: 0 15px 0 15px;">
%TOC{title="Page contents"}%
</div></sticky>

<sticky><div style="margin:15px;"></sticky>

The following article is an example of how you can configure a Reverse Proxy Server using Plug-ins with Liberty Profile.  <br />
More information on Generating Plug-ins for Liberty Profile can be found here: [[http://www-01.ibm.com/support/knowledgecenter/SSEQTP_8.5.5/com.ibm.websphere.wlp.doc/ae/twlp_generate_plugin_cfg_xml.html?cp=SSEQTP_8.5.5&lang=en][Liberty Profile Plugin]]

Note: This example covers an all in one Liberty server CLM implementation.  For enterprise-specific considerations and/or multiple Liberty profiles, see the section  [[#Enterprise_Deployments_and_Multi][Enterprise Deployments and Multiple Liberty profiles.]]

---++ Requirements
In order to create and configure the IHS plugin, you will need to also install:
   * IBM HTTP Server (IHS)
   * Web Server Plug-ins for IBM !WebSphere Application Server
   * IBM SDK (or  JDK)
<br />
And you will need to:
   * Create a Keystore File for IHS
   * Create a Password Stash File for IHS Keystore
   * Create  a Certificate for IHS
   * Create a Keystore File for Liberty Plugin Config
   * Create a Password Stash File for Plugin Config Keystore
   * Export a signer certificate from the Liberty Server and import it into a keystore
   

---+++ Install Each of the Components.
Install IBM HTTP Server, IBM SDK, and Web Server Plug-ins for IBM !WebSphere Application Server
   * Install each of these tools according to the corresponding installation documentation.  
   * In our example, we will be installing each of them in the following directory:  C:\IBM\        
   * Your installation directory may be different and will require you to make corresponding path changes.
<br />
%ORANGE% Our Installation Paths for each component will be: %ENDCOLOR%
<verbatim>
    IBM HTTP Server (IHS)
           C:\IBM\HTTPServer
   WebSphere Plugins 
          C:\IBM\WebSphere\Plugins\
   IBM SDK
          C:\IBM\Java
   CLM Tools
           C:\IBM\clm601\JazzTeamServer\
</verbatim>
<br />


---++ Create a Keystore and Certificate using Ikeyman for the IHS server

---+++ New Key Database
   * Locate and start ikeyman  <br />
     <img src="%ATTACHURLPATH%/ikeyman2.png" alt="ikeyman2.png" width="440" height="196" />

<br />

   * Create a new Key Database File <br />


     <img src="%ATTACHURLPATH%/ikeyman.png" alt="ikeyman.png" width="300" height="188" />


<br />

New Keystore  <br />

   * Select Key database type CMS for versions 6.x. For Version 7.x choose type PKCS12   %ORANGE% (If the CMS option is not available, see note below) %ENDCOLOR%
   * Give a name to your keystore.  %ORANGE% (Our example: IHS_KEY.kdb for type CMS;   IHS_KEY.p12 for type PKCS12) %ENDCOLOR%
   * Enter a path for your keystore  %ORANGE% Recommendation: Put this in the bin directory of the HTTPServer (You will need to remember this for later for the httpd.conf file) %ENDCOLOR%
   * Click *OK*
<br />
<br />
%ORANGE% (Note, To enable the CMS provider, add the following phrase to the java.security file. %ENDCOLOR%

<verbatim>
security.provider.10=com.ibm.security.cmskeystore.CMSProvider
</verbatim> 
%ORANGE% In Java 6, you will find it: %ENDCOLOR%
<verbatim>
...\java60\jre\lib\security\java.security) 
</verbatim>
%ORANGE%  In Java 8, the java.security file is located in this directory: %ENDCOLOR% 
<verbatim> 
.../java/8.0/jre/lib/security/java.security
</verbatim> 
%ORANGE%  In Java 11, the java.security file is located in this directory: %ENDCOLOR% 
<verbatim> 
.../java/11.0/jre/conf/security/java.security
</verbatim> 
<br />


Version 6.x (Type CMS) 
    <img src="%ATTACHURLPATH%/new_ihs_key.png" alt="new_ihs_key.png" width="586" height="170" />

<br />
Version 7.x (Type PKCS12) 
    <img src="%ATTACHURLPATH%/pks12.png" alt="pks12.png" width="586" height="450" />

<br />

   * Enter a password (and confirm)
   * Check the box for the Stash Password to a file
   *  Recommendation: Do not put an expiration date.  If you do, you will need to create a new stash file when this expires.) 
<br />
      <img src="%ATTACHURLPATH%/stach_password.png" alt="stach_password.png" width="188" height="114" />
<br />
<br />

---+++ New Self Signed Certificate for the IHS Keystore
   * Create a new Self Signed Certificate <br />

     <img src="%ATTACHURLPATH%/new_certificate_button.png" alt="new_certificate_button.png" width="164" height="89" /><br />
<br />
   * Enter in information about the server<br /> %ORANGE% (We are using 'default' as our certificate name) %ENDCOLOR%
   * Enter the !WebServer Name      %ORANGE% (Our server name is 'rhayama') %ENDCOLOR%     
   * Change the expiration  to 3650 %ORANGE% (This will avoid coming back in a year to do this again.) %ENDCOLOR%
<br />    
 <img src="%ATTACHURLPATH%/new_certificate_1.png" alt="new_certificate_1.png" width="432" height="556" />
<br />
<br />
<br />
Verify the *default* certificate was created.  <br />
<br />
     <img src="%ATTACHURLPATH%/verify_default_cert.png" alt="verify_default_cert.png" width="273" height="122" />

<br />
<br />

---++ Create a Keystore and Certificate using Ikeyman for the web server Plugin.
%ORANGE% Best Practice is to use a separate keystore for the IHS server and the plugin config file.  %ENDCOLOR%

---+++ New Directory for the plugin config information
<br />
<br />
Prior to creating the new Key Database for the plugin config file, create a new directory in your !WebSphere Plugins directory. %ORANGE% (This is on the IHS server) %ENDCOLOR%
 <br />
As noted above, our plugin install path is:  C:\IBM\WebSphere\plugins <br />
We want to create a new directory for our plugin config file.  <br />
We will call our new directory *WebServer1* and create it in C:\IBM\WebSphere\plugins\config\
<br />
As seen:
<br />
<br />
     <img src="%ATTACHURLPATH%/create_webserv1_dir.png" alt="create_webserv1_dir.png" width="214" height="76" />

<br />
<br />
---+++ Export Signer Certificate
<br />
We need to get a certificate from our Liberty Server.
<br />
<br />
   * Start ikeyman on the Liberty Server.

<br />
%ORANGE% (If your IHS server is on a different server then your Liberty Server, you can use the ikeyman that comes with the CLM installation.
  <br />
In our installation, it is located here:  C:\IBM\clm602\JazzTeamServer\server\jave\jre\bin\ikeyman) %ENDCOLOR%
<br />
<br />
   * In ikeyman, select open 

<br />
<br />
     <img src="%ATTACHURLPATH%/open_kestore2.png" alt="open_kestore2.png" width="113" height="77" />
<br />
<br />
   * •	On versions 7.0.1 and higher, Select Key File type PKCS12 
   * •	On versions 7.0.0 and lower, Select Key File type JKS
   * At the bottom, select Files of Type *All Files*
<br />
<br />
   <img src="%ATTACHURLPATH%/PKCS12-3.png" alt="PKCS12-3.png" width="584" height="172" />
<br />
(7.0.1 and higher)
<br />
<br />
     <img src="%ATTACHURLPATH%/key_db_type_jks.png" alt="key_db_type_jks.png" width="584" height="172" />
<br />
(7.0.0 and lower)
<br />
<br />
   * On versions 7.0.1 and higher, navigate to the Liberty Profile keystore
   * C:\IBM\clm701\JazzTeamServer\server\liberty\servers\clm\resources\security\ibm-team-ssl.p12 
   *On versions 7.0.0 and lower,  navigate to the Liberty Profile keystore
   * C:\IBM\clm601\JazzTeamServer\server\liberty\servers\clm\resources\security\ibm-team-ssl.keystore 
<br />
<br />
     <img src="%ATTACHURLPATH%/ratl_keystore.png" alt="ratl_keystore.png" width="506" height="356" />   
<br />
<br />

   * The password is ibm-team
<br />
<br />
 
   * On the right side, select *Extract Certificate*
<br />
<br />
     <img src="%ATTACHURLPATH%/extract_cert.png" alt="extract_cert.png" width="169" height="49" />
<br />
<br />
   * Accept the default location
<br />
<br />
     <img src="%ATTACHURLPATH%/open_signer_cert.png" alt="open_signer_cert.png" width="584" height="136" />
<br />
<br />
   * Click Okay and verify your certificate was created

<br />
<br />
     <img src="%ATTACHURLPATH%/verify_signer_cert_created.png" alt="verify_signer_cert_created.png" width="554" height="156" />
<br />
<br />
   * Copy this certificate into the !WebServer1 directory you created above. %ORANGE% (On the IHS Server) %ENDCOLOR%
<br />
<br />
     <img src="%ATTACHURLPATH%/copy_cert_to_webserver1.png" alt="copy_cert_to_webserver1.png" width="496" height="136" />

<br />
<br />
   * You can now close ikeyman on the Liberty Server. 
<br />
<br />
---+++ New Key Database
<br />
<br />
Now we will return to Ikeyman on the IHS server.
Ikeyman should still be up.  If it is not, then start it again. 
<br />
<br />
   * Select Key database type CMS (Version 6.x)  /   PKS12 (Version 7.x
   * Give a name to your keystore.  %ORANGE% (Our example: plugin-key.kdb) %ENDCOLOR%
   * Enter a path for your keystore  %ORANGE% Recommendation: Put this in the directory you just created: C:\IBM\WebSphere\plugins\config\WebServer1   %ENDCOLOR%
   * Click *OK*
<br />
<br />
     <img src="%ATTACHURLPATH%/New_plugin-key_kdb.png" alt="New_plugin-key_kdb.png" width="466" height="178" />
<br />
<br />

   * Enter a password (and confirm)
   * Check the box for the Stash Password to a file
   *  Recommendation: Do not put an expiration date.  If you do, you will need to create a new stash file when this expires. 
<br />
<br />
      <img src="%ATTACHURLPATH%/stach_password.png" alt="stach_password.png" width="188" height="114" />
<br />
<br />
---+++ Import Jazz Signer Certificate 
<br />
 %ORANGE% (Instead of creating a certificate like we did for IHS, we will use the exported  signer certificate from the Liberty server.) %ENDCOLOR%
<br /><br />
   * Now import the signer certificate from Liberty Server  <br /> 
<br />
<br />
   * In the middle of the page, you should see Personal Certificate
<br />
<br />

     <img src="%ATTACHURLPATH%/option_personal_cert.png" alt="option_personal_cert.png" width="738" height="112" />
<br />
<br />
   * change this to Signer Certificate:
<br />
<br />
     <img src="%ATTACHURLPATH%/change_option_signer_cert.png" alt="change_option_signer_cert.png" width="722" height="94" />
<br />
<br />
   * Select the *Add* button and navigate to the !WebServer1 directory that you copied the cert.arm into in the preceding step.
<br />
<br />
 %ORANGE% (It should be in the C:\WebSphere\Plugins\config\WebServer1 Directory) %ENDCOLOR%
<br />
<br />
     <img src="%ATTACHURLPATH%/Add_button.png" alt="Add_button.png" width="177" height="69" />
<br />   
<br />    
   * When the *box* comes up, navigate to the cert.arm file.
<br />
<br />  
<img src="%ATTACHURLPATH%/open_signer_cert.png" alt="open_signer_cert.png" width="584" height="136" />
<br />
<br />
   * You will enter a label.  Choose *default*
<br />
<br />
     <img src="%ATTACHURLPATH%/enter_label_webserver1.png" alt="enter_label_webserver1.png" width="314" height="138" />
<br />
<br />
   * You should see a message that you successfully imported the certificate.
<br />
<br />
     <img src="%ATTACHURLPATH%/succesfully_import_cert.png" alt="succesfully_import_cert.png" width="316" height="382" />
<br />
<br />
*You should now be ready to create the plugin config file*

<br />
<br />

---+++ Create the Plug-in Config file

   * To create the Plug-in Config for Liberty Profile, your Liberty Server must be running.   <br />
<br />

   * On versions 6.0.4 and higher, the plugin-cfg.xml is generated automatically at server startup under server_install_dir/server/liberty/servers/clm/logs/state
<br />

   * On versions 6.0.3 and below, the plugin-cfg.xml can be generated by calling an mbean from repodebug from any application using the following steps:
<br /><br />
*Note:  These steps can still be performed even if the server has not yet been configured through /jts/setup*:<br /><br />
1)  Enable Repodebug by going to *https://server:port/app/admin* -> *Advanced Properties*.  For example, *https://clmweb.ibm.com:9443/rm/admin* -> *Advanced Properties*.  
<br /><br />
Locate the advanced property called *Enable repodebug service* and set its value to *true*.  Save the change by clicking *Save* at the top of the page.
<br /><br />
2)  Go to *https://server:port/app/repodebug/mxBeans/WebSphere%3Aname%3Dcom.ibm.ws.jmx.mbeans.generatePluginConfig/operations/generateDefaultPluginConfig()* and click the *POST* button
<br /><br />
The plugin-cfg.xml will be generated under server_install_dir/server/liberty/servers/clm
<br /><br /> <hr>
Alternate method if the server has been started but not yet configured (*should no longer be necessary given options 1 and 2 above*):

   * Run Jconsole  <br />
<verbatim>
C:\IBM\Java70\bin\jconsole
</verbatim> <br />
   * Because we are running on the same system, we can connect to a local process.  <br />
     <img src="%ATTACHURLPATH%/jconsole_start.png" alt="jconsole_start.png" width="404" height="420" /> <br />

<br />

   * Select the ws-server.jar --batch-file start clm process and click *Connect* <br />
     <img src="%ATTACHURLPATH%/jconsole_connection.png" alt="jconsole_connection.png" width="380 height="104" /> <br />
 <br />
 <br />
   * Select the MBeans Tab <br />
     <img src="%ATTACHURLPATH%/mbeans_tab.png" alt="mbeans_tab.png" width="342" height="76" /> <br />
 <br />
 <br />
   * Select the !WebSphere:name=com.ibm.ws.jmx.mbeans.generatePluginConfig MBean located in the !WebSphere directory. <br />
     <img src="%ATTACHURLPATH%/webshere_generate_plugin.png" alt="webshere_generate_plugin.png" width="460" height="240" /> <br />
 <br />
 <br />
   * Expand the Operations and click the *generatePluginConfig* 
<br />
<br />
     <img src="%ATTACHURLPATH%/generate_plugin_config.png" alt="generate_plugin_config.png" width="884" height="480" />
 <br />
 <br />

You must enter two parameters, *P1* and *P2* 
   * P1:  For P1, enter the path for your plugin on the IHS server. %ORANGE% (This is the same directory you put your Liberty Keystore in.  C:\IBM\WebSphere\Plugins\) %ENDCOLOR% 
   * P2:  For P2, enter the !WebServer name %ORANGE% (We will use *WebServer1* ) %ENDCOLOR%

<br />
<br />
     <img src="%ATTACHURLPATH%/webserver1_redo.png" alt="webserver1_redo.png" width="498" height="162" />
<br />
<br />
   * On the Top Right, click the *generatePluginConfig button* 
<br />
<br />
 %ORANGE% (At the end of the article is information on the 'generateDefaultPluginConfig" option instead of the "generatePluginConfig") %ENDCOLOR%<br />
<br />
<br />
      <img src="%ATTACHURLPATH%/click_generate_plugin.png" alt="click_generate_plugin.png" width="294" height="74" /> <br />
 <br />
 <br />
   * You should get a message that the Method was successfully invoked <br />
      <img src="%ATTACHURLPATH%/method_invoked.png" alt="method_invoked.png" width="133" height="60" /> <br />
 <br />
 <br />
   * You should now see your plugin config file
 <br />

 * This will be created on your Liberty Server in the same directory as the Liberty server.xml file.  %ORANGE% (Our example: C:\IBM\clm601\JazzTeamServer\server\liberty\servers\clm) %ENDCOLOR%
<br />
<br />
     <img src="%ATTACHURLPATH%/plugin_created.png" alt="plugin_created.png" width="192" height="146" /> <br />
 <br />
 <br />
  
   * *You will need to copy this over to your IHS server and place in the directory we created for it earlier.*  %ORANGE% (Our example: C:\IBM\WebSphere\Plugins\config\WebServer1) %ENDCOLOR%
<br />
<br />
   * *You can open the plugin config file and verify the contents.  You should see something similar to this snippet:*  
 <br />
 <br />
<verbatim>  

<?xml version="1.0" encoding="UTF-8"?><!--HTTP server plugin config file for WebServer1 generated on 2016.05.17 at 16:14:49 PDT-->
<Config ASDisableNagle="false" AcceptAllContent="false" AppServerPortPreference="HostHeader" ChunkedResponse="false" FIPSEnable="false" IISDisableNagle="false" IISPluginPriority="High" IgnoreDNSFailures="false" RefreshInterval="60" ResponseChunkSize="64" SSLConsolidate="false" TrustedProxyEnable="false" VHostMatchingCompat="false">
   <Log LogLevel="Error" Name="C:\IBM\WebShere\Plugins\logs\WebServer1\http_plugin.log"/>
   <Property Name="ESIEnable" Value="true"/>
   <Property Name="ESIMaxCacheSize" Value="1024"/>
   <Property Name="ESIInvalidationMonitor" Value="false"/>
   <Property Name="ESIEnableToPassCookies" Value="false"/>
   <Property Name="PluginInstallRoot" Value="C:\IBM\WebShere\Plugins"/>
<!-- Configuration generated using httpEndpointRef=defaultHttpEndpoint-->
<!-- The default_host contained only aliases for endpoint defaultHttpEndpoint.
	 The generated VirtualHostGroup will contain only configured web server ports:
		webserverPort=80
		webserverSecurePort=443 -->
   <VirtualHostGroup Name="default_host">
      <VirtualHost Name="*:80"/>
      <VirtualHost Name="*:443"/>
   </VirtualHostGroup>
   <ServerCluster CloneSeparatorChange="false" GetDWLMTable="false" IgnoreAffinityRequests="true" LoadBalance="Round Robin" Name="WebServer1_default_node_Cluster" PostBufferSize="0" PostSizeLimit="-1" RemoveSpecialHeaders="true" RetryInterval="60">
      <Server CloneID="8192ea2e-0dc3-4d34-9766-dc7240d46b43" ConnectTimeout="5" ExtendedHandshake="false" MaxConnections="-1" Name="default_node_WebServer1" ServerIOTimeout="900" WaitForContinue="false">
         <Transport Hostname="192.168.199.254" Port="9080" Protocol="http"/>
         <Transport Hostname="192.168.199.254" Port="9443" Protocol="https">
            <Property Name="keyring" Value="keyring.kdb"/>
            <Property Name="stashfile" Value="keyring.sth"/>
            <Property Name="certLabel" Value="LibertyCert"/>
         </Transport>
      </Server>
</verbatim>
 <br />
 <br />
---++++ Changes to the Plugin Config File
You will need to make some changes to this xml file to match your environment. <br />

Examine the contents of the XML file and look for the following line:
<verbatim>
   <Log LogLevel="Error" Name= ************
</verbatim>
  <br />
Verify that this entry matches the directory you created for your Liberty plugin  <br />
<verbatim>
<Log LogLevel="Error" Name="C:\IBM\WebShere\Plugins\logs\WebServer1\http_plugin.log"/>
</verbatim>
<br />
You will also need to make changes to the Plugin config file regarding the Keystore / Certificate you created earlier in [[#New_Key_Database_AN1][Key Database section]], [[#Import_Jazz_Signer_Certificate][Import Jazz Signer Certifact to Web Server section]]
<verbatim>
            <Property Name="keyring" Value="keyring.kdb"/>  
            <Property Name="stashfile" Value="keyring.sth"/> 
            <Property Name="certLabel" Value="LibertyCert"/> 
</verbatim> <br />
Modify this to match the certificate information you created for liberty plugin. <br />
   * Example Windows
<verbatim>
            <Property Name="keyring" Value="C:\IBM\WebSphere\Plugins\config\WebServer1\plugin-key.kdb"/>  
            <Property Name="stashfile" Value="C:\IBM\WebSphere\Plugins\config\WebServer1\plugin-key.sth"/> 
            <Property Name="certLabel" Value="default"/> 
</verbatim>
   * Example Linux
<verbatim>
            <Property Name="keyring" Value="/opt/IBM/WebSphere/Plugins/config/WebServer1/plugin-key.kdb"/>  
            <Property Name="stashfile" Value="/opt/IBM/WebSphere/Plugins/config/WebServer1/plugin-key.sth"/> 
            <Property Name="certLabel" Value="default"/> 
</verbatim>
 <br />



<br />
<br />
<br />
---++ Modify the httpd.conf File

---+++  SSL Module
   * Search for the following: <br />
!LoadModule ibm_ssl_module modules/mod_ibm_ssl.so
<br />
  Uncomment it out and add the following: <br />
   * The Port you will be listening on (port 443 is the default)
   * The virtual host name ( a * means accept all traffic coming in on port 443)
   * The path to your Key file (created above)
   * The path to the stash file (created above)

<br />
<br />

*EXAMPLE*
<br />
<verbatim>
LoadModule ibm_ssl_module modules/mod_ibm_ssl.so
Listen 0.0.0.0:443
## IPv6 support:

<VirtualHost *:443>
SSLEnable
SSLProtocolDisable SSLv2 SSLv3
 KeyFile C:\IBM\HTTPServer\bin\IHS_key.kdb
 SSLStashFile C:\IBM\HTTPServer\bin\IHS_key.sth
</VirtualHost>

</verbatim>
---+++ Plugin Location
 At the bottom of the httpd.conf file, enter in the path to the plugin file as well as the path to the ap22 module
<br />
   * Windows
<br />
<verbatim>
LoadModule was_ap22_module "C:\IBM\WebSphere\Plugins\bin\32bits\mod_was_ap22_http.dll"
WebSpherePluginConfig "C:\IBM\WebSphere\Plugins\config\WebServer1\plugin-cfg.xml"
</verbatim>
<br />
   * Linux
<br />
<verbatim>
LoadModule was_ap22_module "/opt/IBM/WebSphere/Plugins/bin/32bits/mod_was_ap22_http.so"
WebSpherePluginConfig "/opt/IBM/WebSphere/Plugins/config/WebServer1/plugin-cfg.xml"

</verbatim>
<br />

---+++  Restart IHS Server
*You have now completed the Proxy configuration for Liberty Profile*
<br />
<br />
<br />
<br />
*OPTIONAL INFORMATION*<br />
<br />
<br />
---++ Generate Plugin Options
In the mbean, there are two plugin options:
   * generateDefaultPluginConfig
   * generatePluginConfig
<br />
The generateDefaultPluginConfig operation generates  the plugin-cfg.xml file <br />
However, if you choose this option, you will have to manually enter this information to each corresponding entry in the Plugin config file.

The generatePluginConfig operation is used to customize installation root directory on the !WebServer (IHS Server)  and  Web Server name before you generate the plugin-cfg.xml file. (There are two parameter files with this option) <br />
Parameters for !GeneratePluginConfig:
   * P1 is the "installation root directory 
   * P2 is the "Application server name"
<br />
<br />
---++ Enterprise Deployments and Multiple Liberty Profiles
IHS can only recognize one plugin file.  When you have a distributed deployment, you need to merge the plugin files into a single plugin.  This can be accomplished either manually or with the Plugin Merge Tool.   <br />
*Note:* This requires a full !WebSphere Application Server (WAS) system that is at the same level, or higher, as your Liberty Profile Servers.  It is this WAS system that contains the Plugin Merge tool.
<br />
<br />
   * Plugin Merge Tool
<br />
Run the pluginCfgMerge script to merge the plug-in configurations together into a single file, like this:
<verbatim>
pluginCfgMerge.bat plugin-cfg1.xml plugin-cfg2.xml plugin-cfg3.xml merged-plugin-cfg.xml
</verbatim>
<br />
 %ORANGE% (On linux, the command is pluginCFgMerge.sh) %ENDCOLOR%
<br />
More information on this tool can be found here: [[http://www-01.ibm.com/support/docview.wss?uid=swg21674883][How to create a merged plug-in config for multiple Liberty Profile Servers]]
<br />
<br />
Once the plugin-cfg files are merged, then you will need to edit them as mentioned in [[#Changes_to_the_Plugin_Config_Fil][Changes to the Plugin Config]] section.  Best practice is to create one keystore and certificate per Liberty server in your deployment.  On the IHS server, create a directory to hold each of your keystores and certificates for each Liberty server.  For example, <verbatim>C:\IBM\WebSphere\plugins\config\<serverA>, C:\IBM\WebSphere\plugins\config\<serverB>, etc.</verbatim>
<img src="https://jazz.net/wiki/pub/Deployment/CreatingAProxyServerWithWebSpherePlugins/merged_plugins.png" alt="merged_plugins.png" width="546" height="201" />

Then, repeat the [[#Export_Jazz_Signer_Certificate][Export Signer certificate]],[[#New_Key_Database_AN1][New Key Database]], and [[#Import_Jazz_Signer_Certificate][Import Signer Certificate]] sections once for each Liberty server. 
%RED% You do not need to copy the keystores.  The merged plugin file will be pointing to each of the corresponding keystores in their *home* directories. %ENDCOLOR%
<br />
---++ Troubleshooting
   * Test IHS (without clm)
   Go directly to your proxy server (stem of your Public URI)
<verbatim>
First try without ssl:
http://My_proxy_server

Then try with ssl:
https://My_proxy_server
</verbatim>

If it does not work without ssl, have you started your proxy server? <br />
If it works for non ssl but fails for ssl, then there is a problem with your certificate. <BR />
<BR />
   * Connectivity to CLM
IHS cannot get to your Application server if you cannot get to your application server. <br />
Try to get to your Application server by "bypassing" the IHS server. <br />
In your browser, go to: <br />
<verbatim>
https://your_AppServer:<port>/jts/admin
example:
https://my_clm:9443/jts/admin
</verbatim>

If you cannot get directly to your Application server, is CLM Running? <br />
If you can go directly to your Application server, but not through your proxy server, check your IHS log for errors.  Typically this is a problem with the certificate from the Application server. <br />
<br />
Look at the Plugin.log %ORANGE% (The path is noted in your Plugin-cfg.xml file> %ENDCOLOR% <br />
If you get an error similar to the following:

<verbatim> 
ERROR: lib_security: logSSLError: str_security (gsk error 408): GSK_ERROR_BAD_KEYFILE_PASSWORD
[Tue Apr 5 11:42:03 2010] 00001750 00000bec - ERROR: lib_security: initializeSecurity: Failed to initialize GSK environment
[Tue Apr 5 11:42:03 2010] 00001750 00000bec - ERROR: ws_transport: transportInitializeSecurity: Failed to initialize security
[Tue Apr 5 11:42:03 2010] 00001750 00000bec - ERROR: ws_server: serverAddTransport: Failed to initialize security

</verbatim>
The problem is possibly:
   * You have a bad Keystore / Certificate / Stash file
If this is the problem, recreate the Keystore / Certificate / Stash file <br />
<br />
   * You have not modified both the httpd.conf and Plugin-cfg.xml file with the correct information
Verify your information is correct <br />
<br />
   * You have an old certificate in your browser
Open your browser, delete your old certificate, clear your cache, restart the servers. (Don't just restart the services, actually restart the servers) <br />
When you try connecting you will have to re-import the certificate. <br />

   * Visualization of steps required to create a liberty profile IHS: <br />
     <img src="%ATTACHURLPATH%/CreatingLibertyProfileIHSVisualization.png" alt="CreatingLibertyProfileIHSVisualization.png" width="1250" height="800" />

---+++++!! Related topics: [[DeploymentWebHome][Deployment web home]], [[DeploymentWebHome][Deployment web home]]

---+++++!! External links:          

   * [[https://www.ibm.com][IBM]]

---+++++!! Additional contributors: Main.BenSilverman, Main.RosaNaranjo, Main.BrianLahaie

<sticky></div></sticky>
Attachments
Topic attachments
I	Attachment	Action	Size	Date	Who	Comment
png	CreatingLibertyProfileIHSVisualization.png	manage	884.2 K	2023-01-06 - 22:01	RosaNaranjo	Visualization of steps required to create a liberty profile IHS
png	JKS-2.png	manage	48.0 K	2020-09-24 - 13:33	UnknownUser
png	PKCS12-2.png	manage	1.0 K	2020-09-24 - 13:34	UnknownUser
png	PKCS12-3.png	manage	69.0 K	2020-09-24 - 13:45	UnknownUser
png	pks12.png	manage	194.3 K	2020-09-22 - 10:36	UnknownUser	pks12 screen shot
Deployment
Community information and contribution guidelines
Status icon key:
To do
Under construction
New
Updated
Constant change
None - stable page
Smaller versions of status icons for inline text:
Copyright © by IBM and non-IBM contributing authors. All material on this collaboration platform is the property of the contributing authors.
Contributions are governed by our Terms of Use. Please read the following disclaimer.
Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.