SSL configuration between Plug-in and WebSphere Application server

SSL configuration between Plug-in and WebSphere Application server

I. Create the SSL artifacts Needed by the Application Server

    1. Start the iKeyman utility that comes with WebSphere AS.
    2. Create a key file for the web container.
        a. For the Key Database type, select JKS
        b. For File Name, enter WebContainerKeyFile.jks
        c. Select the location to save the key file.
        d. Click OK
        e. In the next pop-up dialog, specify and confirm a password for key file access.

   3. Create a self-signed certificate for the web container
       a. First, Open the JKS using ikeyman. This will show the key database contents.
       b. Click on the “down arrow” to the right, to display a list of three choices.
            Personal Certificates
            Personal Certificate Requests
            Signer Certificates
          Select Personal Certificate and click New Self-Signed.
      c. Now, a new window will pop up. here you need to input details about the certificate and your 

          organization. Click OK.
      d. Select the certificate that you created now and click Extract Certificate. 

          Enter the File name (.arm) and location. Click OK.
      e. Copy this certificate to the HTTP server machine on which the key file for plug-in was created.

   4. Create a trust file to be used by the web container

      a. For the Key Database Type, select JKS.
      b. Enter a file name (.jks).
      c. Enter location.
      d. Click OK.
      e. In the next pop-up dialog, specify and confirm a password for key file access.

   5. Import the plug-in certificate
      a. With the Signer Certificate selectd in the key database content pane, click Add.
      b. Browse to where you copied the IHS plud-in certificate and click OK.
      c. In the next panel, enter a label for the certificate.
      d. Click OK.

  6. The web container key and trust file are complete. Copy these two files to other nodes.
  7. Next, add the web container certificate to the plug-in key file.
       a. Start iKeyman tool.
       b. Open the plug-in key file.
       c. Select the Signer Certificate and click Add.
       d. Browse to the location where the web container .arm file.
       e. Click OK and provide a label in the next pop-up window.
       f. Click OK to have the certificate added to the Signer Certificate.

=================================================================

Follow the steps below to configure the SSL artifacts in WebSphere.

1.  SSL certificate and key management > Key stores and certificates > New >

    Give Name : WebContainerKey
    Management scope : Cell

    Path : /opt/Key/WebContainerKey.jks

    Password:
    TYpe : jks

    Apply.

2. Repeat the steps for Trust file

    Give Name : WebContainerTrust
    Management scope : Cell

    Path : /opt/Key/WebContainerTrust.jks

    Password:
    Type : jks

    Apply.

3. SSL certificate and key management > SSL configurations > New

    Name : WebContainerCerts
    Trust store name : WebContainerTrust
    Keystore name  : WebContainerKey
    Click on "Get Certificate Aliases"
    Managemanet Scope : Cell

    Apply.

4. Application servers > plant1 > Web container transport chains > WCInboundDefaultSecure > SSL inbound channel (SSL_2)

    SSL Configuration > Specific to this endpoint
    Select SSL Configuration

    Select : WebContainerCerts
   
    Apply.

    Disable :     HttpQueueInboundDefault,  WCInboundDefault

=========================================================