[Version 6 only]WebSphere Application Server - Express, Version 6.0.x     Operating Systems: AIX, HP-UX, Linux, Solaris, Windows

Configuring trust anchors for the generator binding on the application level

Before you begin

This document describes how to configure trust anchors for the generator binding at the application level. It does not describe how to configure trust anchors at the server or cell level. Trust anchors defined at the application level have a higher precedence over trust anchors defined at the server or cell level. For more information on creating and configuring trust anchors on the server or cell level, see Configuring trust anchors on the server or cell level.

You can configure a trust anchor for the application-level trust anchor using an Application Server Toolkit or the administrative console. This document describes how to configure the application-level trust anchor using the administrative console.

Why and when to perform this task

A trust anchor specifies key stores that contain trusted root certificates, which validate the signer certificate. These key stores are used by the request generator and the response generator (when Web services is acting as client) to generate the signer certificate for the digital signature. The keystores are critical to the integrity of the digital signature validation. If they are tampered with, the result of the digital signature verification is doubtful and comprised. Therefore, it is recommended that you secure these keystores. The binding configuration specified for the request generator must match the binding configuration for the response generator.

The trust anchor configuration for the request generator on the client must match the configuration for the request consumer on the server. Also, the trust anchor configuration for the response generator on the server must match the configuration for the response consumer on the client.

Complete the following steps to configure trust anchors for the generator binding on the application level:

Steps for this task

  1. Locate the trust anchor panel in the administrative console.
    1. Click Applications > Enterprise applications > application_name.
    2. Under Related Items, click EJB Modules or Web Modules > URI_name.
    3. Under Additional Properties you can access the trust anchor configuration for the following bindings:
      • For the request generator (sender) binding, click Web services: Client security bindings. Under Request generator (sender) binding, click Edit custom.
      • For the response generator (sender) binding, click Web services: Server security bindings. Under Response generator (sender) binding, click Edit custom.
    4. Under Additional properties, click Trust anchors.
    5. Click New to create a trust anchor configuration, click Delete to delete an existing configuration, or click the name of an existing trust anchor configuration to edit its settings. If you are creating a new configuration, enter a unique name in the Trust anchor name field.
  2. Specify the keystore password, the keystore location, and the keystore type. Key store files contain public and private keys, root certificate authority (CA) certificates, the intermediate CA certificate, and so on. Keys retrieved from the keystore are used to sign and validate or encrypt and decrypt messages or message parts. If you specified the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator implementation for the key locator class implementation, you must specify a key store password, location, and type.
    1. Specify a password in the Key store password field. This password is used to access the keystore file.
    2. Specify the location of the key store file in the Key store path field.
    3. Select a keystore type from the Key store type field. The Java Cryptography Extension (JCE) used by IBM supports the following key store types:
      JKS
      Use this option if you are not using Java Cryptography Extensions (JCE) and if your keystore file uses the Java Keystore (JKS) format.
      JCEKS
      Use this option if you are using Java Cryptography Extensions.
      PKCS11KS (PKCS11)
      Use this format if your keystore uses the PKCS#11 file format. Keystores using this format might contain RSA keys on cryptographic hardware or might encrypt keys that use cryptographic hardware to ensure protection.
      PKCS12KS (PKCS12)
      Use this option if your keystore uses the PKCS#12 file format.
      WebSphere Application Server provides some sample keystore files in the ${USER_INSTALL_ROOT}/etc/ws-security/samples directory. For example, you might use the enc-receiver.jceks keystore file for encryption keys. The password for this file is Storepass and the type is JCEKS.
      Attention: Do not use these keystore files in a production environment. These samples are provided for testing purposes only.

Result

This task configures trust anchors for the generator binding at the application level.

What to do next

You must specify a similar trust anchor configuration for the consumer.



Sub-topics
Trust anchor collection
Trust anchor configuration settings

Related tasks
Securing Web services for version 6.0.x applications based on WS-Security

Task topic    

Terms of Use | Feedback

Last updated: Jun 8, 2005 12:45:23 PM EDT
http://publib.boulder.ibm.com/infocenter/wasinfo/v6r0/index.jsp?topic=/com.ibm.websphere.express.doc/info/exp/ae/twbs_conftrancgenapp.html

© Copyright IBM Corporation 2004, 2005. All Rights Reserved.
This information center is powered by Eclipse technology. (http://www.eclipse.org)