Sun Microsystems 5.1.1 manual Creating a KeyStore in PKCS12 Format

Page 31

Chapter 4

Section 4.2

Operating SSL

KeyStores and TrustStores

This command generates a certificate signing request which can be provided to a CA for a certificate request. The file client.csr contains the CSR in PEM format.

Some CA (one trusted by the Web server to which the eWay is connecting) must sign the CSR. The CA generates a certificate for the corresponding CSR and signs the certificate with its private key. For more information, visit the following web sites:

http://www.thawte.com

or

http://www.verisign.com

If the certificate is chained with the CA’s certificate, perform step 1; otherwise, perform step 2 in the following list:

1The following command assumes the client certificate is in the file client.cer and the CA’s certificate is in the file CARoot.cer:

keytool -import -keystore clientstore -file client.cer -alias client

This command imports the certificate (which can include more than one CA in addition to the Client’s certificate).

Also use the following command to import the CA’s certificate into the KeyStore for chaining with the client’s certificate:

keytool -import -keystore clientkeystore -file CARootcer -alias theCARoot

2The following command imports the client’s certificate signed by the CA whose certificate was imported in the preceding step:

keytool -import -keystore clientkeystore -file client.cer -alias client

The generated file clientkeystore contains the client’s private key and the associated certificate chain used for client authentication and signing. The KeyStore and/or clientkeystore, can then be used as the eWay’s KeyStore.

See the “KeyStores” on page 29 for more information.

Creating a KeyStore in PKCS12 Format

This section explains how to create a PKCS12 KeyStore to work with JSSE. In a real working environment, a customer could already have an existing private key and certificate (signed by a known CA). In this case, JKS format can not be used, because it does not allow the user to import/export the private key through keytool. It is necessary to generate a PKCS12 database consisting of the private key and its certificate.

The generated PKCS12 database can then be used as the eWay’s KeyStore. The keytool utility is currently lacking the ability to write to a PKCS12 database. However, it can read from a PKCS12 database.

Note: There are additional third-party tools available for generating PKCS12 certificates, if you want to use a different tool.

HTTPS eWay Adapter User’s Guide

31

Sun Microsystems, Inc.

Page 30 Page 32
Image 31
Page 30 Page 32
Contents EWAY Https Adapter USER’S Guide Version Contents Http OTD Method Descriptions Http Settings Proxy Configuration Security AuthenticationAdditional SSL Section Notes Verify hostname Server Mode Operation Connection Pool SettingsImplementing the Https eWay JCD Sample Projects Running the Sample Running the Sample in SSL ModeWhat’s in This Chapter About Http and HttpsHttp Messages About the Https eWayWeb Browser Cookies GET and Post Methods Sample Http Exchange in Client ModeCookie Expiration Date Checking Body Html Sample Http Exchange in Server ModeSample Input Form What’s New in This ReleaseAbout This Document Https eWay Javadoc ScopeIntended Audience Text ConventionsSun Microsystems, Inc. Web Site Related DocumentsDocumentation Feedback Https eWay System Requirements Installing the Https eWayAfter you have installed eGate or eInsight, do the following Installing the Https eWay on an eGate supported systemSteps to extract the Sample Projects include After InstallationExtracting the Sample Projects and Javadocs Steps to extract the Javadoc includeImport the Project Ican 5.0 Project Migration ProceduresInstall Java Caps Export the ProjectInstalling Enterprise Manager eWay Plug-Ins Https eWay Alert Codes Viewing Alert CodesTo add plug-ins from the Enterprise Manager To View the eWay Alert CodesHTTPCLIENTEWAY-CONNECT Https Client OTD Overview of eWay OTDsHttp OTD Method Descriptions Https Server OTDInput Server Request Node Working with the Server OTD Input Server Response NodeSendResponse Example Collaboration ExampleOverview Operating SSLHttps eWay HackerCreating a KeyStore in JKS Format KeyStores and TrustStoresGenerating a KeyStore and TrustStore KeyStoresTo generate a KeyStore Creating a KeyStore in PKCS12 Format To create a new TrustStore Using an Existing TrustStoreTrustStores Creating a TrustStoreSSL Handshaking Server ClientEWay Server Web Client EWayCreating a Sample CA Certificate Using the OpenSSL UtilitySigning Certificates With Your Own CA # SSLeay example properties file Windows OpenSSL.cnf File ExampleChapter Section Operating SSL Using the OpenSSL Utility Copyright 1998-2001 The OpenSSL Project. All rights reserved Configuring the eWay Connectivity Map Properties Creating and Configuring the Https eWayTo configure the Https Server eWay properties To configure the Https eWay propertiesConnectivity Map with Components Server Configuring the eWay Environment PropertiesEWay Connectivity Map Properties To Configure the Environment PropertiesHttp eWay-HTTP Settings Configuring the Connectivity Map Https eWay PropertiesHttps eWay Configuration Sections Include Https Server eWay Configuration Sections IncludeEWay Environment Properties Http Server eWay-HTTP Server External ConfigurationEnvironment Configuration-HTTP Settings Http SettingsEnvironment Configuration-Proxy Configuration Proxy ConfigurationProxy Username Proxy passwordSecurity Name Description Required Value Proxy PortEnvironment Configuration-Security, Authentication AuthenticationEnvironment Configuration-Security, SSL Com.ibm.jsse.IBMJSSEProvid Name Description Required Value Jsse Provider ClassCom.sun.net.ssl.internal.ssl.P RoviderRequired Values Additional SSL Section NotesVerify hostname DescriptionEnvironment Configuration-Connection Pool Settings Connection Pool SettingsAdditional information Setting Acceptor Threads Property for Https Server Mode EInsight Engine and Components Implementing the Https eWay Bpel Sample ProjectsNode Name Description Server Mode OperationHttps eWay With eInsight Receive Business Rule Designer Output NodesReceive Business Rule Designer Output Nodes Importing a Sample Project About the Https eWay eInsight Sample ProjectsProject Overview Building and Deploying the prjHTTPClientBPEL Sample ProjectProject Operations GET Command GetSample.xmlInput and Output Data Sample DTD MultipleDataIn.dtd Post Command PostSample.xmlCreating a Project Creating the OTDOTD Wizard Selection Include DTDs to Selected List OTD Options Creating a Business ProcessLogic of the Business Process To create a Business Process Business Process CasesCase Activity Result Business Process Icons Client Business Process With Link Business Rules Client Business Rule Designer First Link Business Rule Business Rule Designer Second Link Business Rule Business Rule Designer Third Link Business Rule Business Rule Designer Case 1 Business Rule Business Rule Designer Case 2 Business Rule Decision Gate Properties Dialog Box Case To create a Connectivity Map Creating a Connectivity MapTo select external applications Selecting External ApplicationsPopulating the Connectivity Map Defining the Business ProcessSteps required to bind eWay components together Binding the eWay ComponentsEnvironment Editor envHTTPClientBPEL Creating an EnvironmentCmHTTPClient Outbound File eWay Settings Configuring the eWaysConfiguring the Https eWay Properties CmHTTPClient Inbound File eWay SettingsCreating and Activating the Deployment Profile Configuring the Integration ServerCreate and Start the Domain Creating and Starting the DomainRunning the Sample Building and Deploying the ProjectBuild the Project Building and Deploying the prjHTTPServerBPEL Sample Project ƒ postBPELHTTPS Content of postBPELHTTPS.html isServer Sample Project Original Form Project FormsServer Sample Project Input Form Next step is to create the Project’s Business Process Business Process Icons for Receive and Reply Business Process Icons With Server Business Rules Business Rule Designer Server Receive Business Rule Creating a Connectivity Map Connectivity Map With Components prjHTTPServerBPEL Creating an Environment ƒ postBPELHTTPS.html input file Running the Sample in SSL ModePermission java.util.PropertyPermission * read, write About the Https eWay JCD Sample Projects Implementing the Https eWay JCD Sample ProjectsBuilding and Deploying the prjHTTPClientJCD Sample Project Https eWay Sample Project Java Collaboration Based SampleIn DTD SampleIn.dtd Creating the Collaboration Definition Java JcdHTTPClient Collaboration Definition Part 101 Connectivity Map With Components prjHTTPClientJCD 103 ƒ Project Overview on Building and Deploying the prjHTTPServerJCD Sample Projectƒ postJCEHTTPS 106 107 JcdHTTPServer Collaboration Definition Connectivity Map With Components prjHTTPServerJCD 110 ƒ postJCEHTTPS.html input file 112 Index 114
Top Page Image Contents