Hi,

I have a doubt about key DB since long time ago, would like to clarify here.

We know WAS7 has default keystores, like key.p12 and trust.p12, and we can use AdminConsole to export whatever certificate.

One of my colleague, he is so get used to use ikeyman, each time when there is a request for SSL cert from newly setup WAS server, he'd create a new kdb(say ikeymanDB.kdb) by using ikeyman, put it somewhere under WAS root installation, say {WAS-ROOT}/default/etc/ikeymanDB.kdb, and again through ikeyman, he generates a self-signed SSL cert (say abc.arm) then pass it to 3rparty, and this works fine all the time.

Question is: Since WAS 7 use default keystore key.p12 and trust.p12, not newly created keystore ikeymanDB.kdb, how does WAS know cert abc.arm which generated from new keyDB ikeymanDB.kdb? 

Hope I made myself understood.

Thanks,

Eric

Hi Eric,

  I don't understand so well your question.  Are you saying that the self-signed certificate is not imported into WAS repositories?
 
  Depending on your application (how it use the certificate), the ssl certificates can be found in the classpath of the server (JVM) so if you put jks (java) or kdb (C) in the classpath your application can found it.
 
  Your server certificate is the new generated self-signed certificate? or you only generate and pass to 3rparty?

 you always can enable ssl traces and check how is founding the self-signed certificate.
 
regards

Hi Gabriel,

Understand that SSL cert able to be found through classpath, my question is a little bit different, I try to make myself understood here.

The story is: my colleague each time will create a new keystore (say abc.kdb through ikeyman) when SSL cert is required say by IHS server for SSL communication.

He would normally save that abc.kdb file under:
         /opt/IBM/WebSphere/AppServer/etc
then export a self-signed cert from that keystore.

It is working fine all the time.

But since WAS7.0, a self-signed cert can be easily generated through AdminConsole, which generated based on default keystore key.p12 (normally under: /opt/IBM/WebSphere/AppServer/profiles/DMGR_XXX/etc)

Now we have at least 2 key store files, default key.p12 and newly created abc.kdb, question is how does WAS realize/know that a new abc.kdb is created so that WAS can accept whatever CERT generated from abc.kdb?

Thanks,
Eric