Hello Alan,
from your update " ... previous version used HTTP, and the newer version uses HTTPS ..." it is not clear to me if you WAS installation is the client for the HTTP(s) traffic or the server? I.e. If you WAS accessed via HTTPS (i.e WAS is the server) or is the application running on WAS accessing external services via HTTPS (i.e WAS is the client) or both?
If your WAS installation is the client you need to establish trust with the server/service. This is done in WAS by adding the signer certificate of the servers certificate (i.e. the certificate provided by the server/service you are accessing) to the respective trust store. The trust-store you can determine from the SSL Configuration being used (Security > Global Security > SSL certificate and key management > SSL configurations). The SSL Configuration gives you the trust- and the keystore being used. By default this is the NodeDefaultTrustStore (for standalone installations) or the CellDefaultTrustSture (if you are running in an SSL configuration). To add the signer please follow the steps from the Link Oscar provided below or try the
Retrieve Signers from a remove SSL Port capability of WAS.
If your WAS installation is the server it depends on where in your architecture SSL is terminated. If the full data communication is is encrypted (what is recommended) you need to create a certificate on every hop and make sure that the previous hop trusts the signer of the certificate.
For example if you have the following architecture: LoadBalancer > Reverse Proxy > HTTPServer > WAS then the LoadBalancer must trust the signer of the certificate provided be the Reverse Proxy, the Reverse Proxy must trust the signer of the certificate provided by the HTTP server etc. (that's standard HTTPS business).
In a WAS environment you usually have an HTTP Server running the WAS Plugin which then balances the load to the WAS Application Server JVMs behind (which actually provide the service). As the HTTP server can be part of the WAS cell (depending on the HTTP server you use) trust between WAS Plugin and WAS Servers is established as you create and manage the certificates via the WAS Admin Console. The certificate provided ny the HTTP Server to the client however is independent from WAS as this is usually from a trusted CA.
Talking about trusted CA. The WAS cell be default creates a signer CA which signs all certificates within the cell. Hence by default all WAS servers trust each other. However if that is not acceptable for your security requirements and you want for example us a different CA (many customers are using the in-house CA) you can replace the standard certificates with certificates signed by the in-house CA.
Please see again Oscar's links below for how to create a CSR and import the signed certificate. The following
link provides an overview of the required steps.
Hope that helps. Please let me know if you have further questions - Hermann
------------------------------
Hermann Huebler
2innovate IT Consulting GmbH
Vienna
Austria
#IBMChampion
------------------------------