Use the WebSphere® Application Server administrative console
to configure trust anchors that specify key stores which contain trusted root
certificates to validate the signer certificate.
Before you begin
Important: There is an important distinction between Version
5.x and Version 6 and later applications. The information in this article
supports Version 5.x applications only that are used with WebSphere Application
Server Version 6.0.x and later. The information does not apply to Version
6.0.x and later applications.
This document describes how
to configure trust anchors or trust stores at the application level. It does
not describe how to configure trust anchors at the server or cell level. Trust
anchors defined at the application level have a higher precedence over trust
anchors defined at the server or cell level. For more information on creating
and configuring trust anchors at the server or cell level, see either Configuring the server security bindings using an assembly tool or Configuring the server security bindings using the administrative console.
You can configure an application-level trust anchor
using an assembly tool or the administrative console. This document describes
how to configure the application-level trust anchor using the administrative
console.
About this task
A trust anchor specifies key stores that contain trusted root
certificates, which validate the signer certificate. These key stores are
used by the request receiver (as defined in the ibm-webservices-bnd.xmi file)
and the response receiver (as defined in the ibm-webservicesclient-bnd.xmi file
when Web services is acting as client) to validate the signer certificate
of the digital signature. The keystores are critical to the integrity of the
digital signature validation. If they are tampered with, the result of the
digital signature verification is doubtful and comprised. Therefore, it is
recommended that you secure these keystores. The binding configuration specified
for the request receiver in the ibm-webservices-bnd.xmi file must
match the binding configuration for the response receiver in the ibm-webservicesclient-bnd.xmi file.
The
following steps are for the client-side response receiver, which is defined
in the ibm-webservicesclient-bnd.xmi file and the server-side request
receiver, which is defined in the ibm-webservices-bnd.xmi file.
Procedure
- Configure an assembly tool to work with a Java Platform,
Enterprise Edition (Java EE) enterprise application. For
more information, see the related information on Assembly Tools.
- Create a Web services-enabled Java EE enterprise application. See
either Configuring the server security bindings using an assembly tool or Configuring the server security bindings using the administrative console for an introduction on
how to manage Web services security binding information on the server.
- Click Applications > Application Types > WebSphere enterprise
applications > enterprise_application.
- Under Manage modules, click URI_name.
- Under Web Services Security Properties, click Web services:
client security bindings to edit the response receiver binding information,
if Web services is acting as a client.
- Under Response receiver binding, click Edit.
- Under Additional properties, click Trust anchors.
- Click New to create a new trust anchor.
- Enter a unique name within the request receiver binding for
the Trust anchor name field. The name is used to reference the
trust anchor that is defined.
- Enter the key store password, path, and key store type.
- Click the trust anchor name link to edit the selected trust
anchor.
- Click Remove to remove the selected trust anchor or anchors.
When you start the application, the configuration is validated in
the run time while the binding information is loading.
- Return to the Web services-enabled module panel accessed in step
2.
- Under Web Services Security Properties, click Web services:
server security bindings to edit the request receiver binding information.
- Under Request receiver binding, click Edit.
- Under Additional properties, click Trust anchors.
- Click New to create a new trust anchor
Enter
a unique name within the request receiver binding for the Trust anchor name
field. The name is used to reference the trust anchor that is defined.
Enter
the key store password, path, and key store type.
Click the trust anchor
name link to edit the selected trust anchor.
Click Remove to
remove the selected trust anchor or anchors.
When you start the application,
the configuration is validated in the run time while the binding information
is loading.
- Save the changes.
Results
This procedure defines trust anchors that can be used by the request
receiver or the response receiver (if the Web services is acting as client)
to verify the signer certificate.
Example
The request receiver or the response receiver (if the Web service
is acting as a client) uses the defined trust anchor to verify the signer
certificate. The trust anchor is referenced using the trust anchor name.