You can configure trust anchors for the consumer binding at the application level.
This article does not describe how to configure trust anchors at the server or cell level. Trust anchors that are defined at the application level have a higher precedence over trust anchors that are defined at the server or cell level. For more information on creating and configuring trust anchors on the server or cell level, see Configuring trust anchors on the server or cell level .
You can configure a trust anchor at the application level using an assembly tool or the administrative console. This article describes how to configure the application-level trust anchor using the administrative console.
A trust anchor specifies key stores that contain trusted root Certificate Authority (CA) certificates, which validate the signer certificate. These keystores are used by the request consumer (as defined in the ibm-webservices-bnd.xmi file) and the response consumer (as defined in the ibm-webservicesclient-bnd.xmi file when a Web service is acting as a client) to validate the X.509 certificate in the SOAP message. The keystores are critical to the integrity of the digital signature validation. If the keystores are tampered with, the result of the digital signature verification is doubtful and comprised. Therefore, it is recommended that you secure these keystores. The binding configuration specified for the request consumer in the ibm-webservices-bnd.xmi file must match the binding configuration for the response consumer in the ibm-webservicesclient-bnd.xmi file. The trust anchor configuration for the request consumer on the server side must match the request generator configuration on the client side. Also, the trust anchor configuration for the response consumer on the client side must match the response generator configuration on the server side.
Complete the following steps to configure trust anchors for the consumer binding on the application level: