A trust anchor specifies key stores that contain trusted
root certificates, which validate the signer certificate. These key stores
are used by the request generator and the response generator (when Web services
is acting as client) to generate the signer certificate for the digital signature.
You can configure trust anchors for the generator binding at the application
level by using the administrative console.
Before you begin
You can configure a trust anchor using an assembly tool or the
administrative console. This task describes how to configure the application-level
trust anchor using the administrative console. For more information on assembly
tools, see the related information.
About this task
The keystores are critical to the integrity of the digital signature
validation. If they are tampered with, the result of the digital signature
verification is doubtful and comprised. Therefore, it is recommended that
you secure these keystores. The binding configuration that is specified for
the request generator must match the binding configuration for the response
generator.
The trust anchor configuration for the request generator
on the client must match the configuration for the request consumer on the
server. Also, the trust anchor configuration for the response generator on
the server must match the configuration for the response consumer on the client.
Trust anchors defined at the application level have a higher
precedence over trust anchors defined at the server or cell level. How to
configure trust anchors at the server or cell level is not described in this
task. For more information on creating and configuring trust anchors on the
server or cell level, see Configuring trust anchors on the server or cell level.
Complete
the following steps to configure trust anchors for the generator binding on
the application level:
Procedure
- Locate the trust anchor panel in the administrative console.
- Click Applications > Application Types > WebSphere
enterprise applications > application_name.
- Under Manage modules, click URI_name.
- Under Web Services Security Properties you can access the trust
anchor configuration for the following bindings:
- For the request generator (sender) binding, click Web services: Client
security bindings. Under Request generator (sender) binding, click Edit
custom.
- For the response generator (sender) binding, click Web services: Server
security bindings. Under Response generator (sender) binding, click Edit
custom.
- Under Additional properties, click Trust anchors.
- Click New to create a trust anchor configuration, click Delete to
delete an existing configuration, or click the name of an existing trust anchor
configuration to edit its settings. If you are creating a new configuration,
enter a unique name in the Trust anchor name field.
- Specify the keystore password, the keystore location, and the keystore
type. Key store files contain public and private keys, root certificate
authority (CA) certificates, the intermediate CA certificate, and so on. Keys
retrieved from the keystore are used to sign and validate or encrypt and decrypt
messages or message parts. If you specified the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator
implementation for the key locator class implementation, you must specify
a key store password, location, and type.
- Specify a password in the Key store password field.
This password is used to access the keystore file.
- Specify the location of the key store file in the Key store
path field.
- Select a keystore type from the Key store type field.
The Java™ Cryptography Extension (JCE) used by IBM® supports the
following key store types:
- JKS
- Use this option if you are not using Java Cryptography Extensions (JCE) and if
your keystore file uses the Java Keystore (JKS) format.
- JCEKS
- Use this option if you are using Java Cryptography Extensions.
- JCERACFKS
- Use JCERACFKS if the certificates are stored in a SAF key ring (z/OS® only).
- PKCS11KS (PKCS11)
- Use this format if your keystore uses the PKCS#11 file format. Keystores
using this format might contain RSA keys on cryptographic hardware or might
encrypt keys that use cryptographic hardware to ensure protection.
- PKCS12KS (PKCS12)
- Use this option if your keystore uses the PKCS#12 file format.
WebSphere® Application Server provides some sample
keystore files in the following directory, using the USER_INSTALL_ROOT variable:
For
example, you might use the enc-receiver.jceks keystore file for encryption
keys. The password for this file is Storepass and the type is JCEKS.
Restriction: Do not use these keystore files in a production environment.
These samples are provided for testing purposes only.
Results
This task configures trust anchors for the generator binding at the
application level.
What to do next
You must specify a similar trust anchor configuration for the consumer.