A trust anchor specifies key stores that contain
trusted root certificates, which validate the signer certificate.
These key stores are used by the request generator and the response
generator (when web services are acting as client) to generate the
signer certificate for the digital signature. You can configure trust
anchors for the generator binding at the application level by using
the administrative console.
Before you begin
You can configure a trust anchor using an assembly tool
or the administrative console. This task describes how to configure
the application-level trust anchor using the administrative console.
For more information on assembly tools, see the related information.
About this task
The keystores are critical to the integrity of the digital
signature validation. If they are tampered with, the result of the
digital signature verification is doubtful and comprised. Therefore,
it is recommended that you secure these keystores. The binding configuration
that is specified for the request generator must match the binding
configuration for the response generator.
The trust anchor configuration
for the request generator on the client must match the configuration
for the request consumer on the server. Also, the trust anchor configuration
for the response generator on the server must match the configuration
for the response consumer on the client.
Complete the following steps to configure
trust anchors for the generator binding on the application level:
Procedure
- Locate the trust anchor panel in the administrative console.
- Click .
- Under Manage modules, click URI_name.
- Under Web Services Security Properties you can access
the trust anchor configuration for the following bindings:
- For the request generator (sender) binding, click Web
services: Client security bindings. Under Request generator
(sender) binding, click Edit custom.
- For the response generator (sender) binding, click Web
services: Server security bindings. Under Response generator
(sender) binding, click Edit custom.
- Under Additional properties, click Trust
anchors.
- Click New to create a trust anchor
configuration, click Delete to delete an existing
configuration, or click the name of an existing trust anchor configuration
to edit its settings. If you are creating a new configuration,
enter a unique name in the Trust anchor name field.
- Specify the keystore password, the keystore location, and
the keystore type. Key store files contain public and private
keys, root certificate authority (CA) certificates, the intermediate
CA certificate, and so on. Keys retrieved from the keystore are used
to sign and validate or encrypt and decrypt messages or message parts.
If you specified the com.ibm.wsspi.wssecurity.keyinfo.KeyStoreKeyLocator implementation
for the key locator class implementation, you must specify a key store
password, location, and type.
- Specify a password in the Key store password field.
This password is used to access the keystore file.
- Specify the location of the key store file in the Key
store path field.
- Select a keystore type from the Key store
type field. The Java Cryptography
Extension (JCE) used by IBM® supports the following key store
types:
- JKS
- Use this option if you are not using Java Cryptography
Extensions (JCE) and if your keystore file uses the Java Keystore
(JKS) format.
- JCEKS
- Use this option if you are using Java Cryptography
Extensions.
- PKCS11KS (PKCS11)
- Use this format if your keystore uses the PKCS#11 file format.
Keystores using this format might contain RSA keys on cryptographic
hardware or might encrypt keys that use cryptographic hardware to
ensure protection.
- PKCS12KS (PKCS12)
- Use this option if your keystore uses the PKCS#12 file format.
WebSphere® Application Server
provides some sample keystore files in the following directory, using
the USER_INSTALL_ROOT variable: c:\{USER_INSTALL_ROOT}\etc\ws-security\samples${USER_INSTALL_ROOT}/etc/ws-security/samples
For
example, you might use the enc-receiver.jceks keystore
file for encryption keys. The password for this file is Storepass and
the type is JCEKS.
Restriction: Do
not use these keystore files in a production environment. These samples
are provided for testing purposes only.
Results
This task configures trust anchors for the generator binding
at the application level.
What to do next
You must specify a similar trust anchor configuration for
the consumer.