I have my ssl.TrustManagerFactory.algorithm set to PKIX , when the application tries to connect to other external sites over https , sometime the SSL negotiation requires the entire chain of certs primary, root and intermediate.

How do I make WebSphere to bypass the full cert chain checking and just use intermediate/root certs for SSL negotiation ? The primary certs usually have a validity of an year and it is tough to keep up with the maintenance of them.

------------------------------
Madhava
------------------------------

Hello Madhava,
not sure I got your questions right but looks like you want to avoid to have to renew the the certificates every year. Is that right?

As you've mentioned the server certificates are usually valid for one year only. Therefore your should not add the server certificate into the trust store but the signer certificate. I.e. the certificate of the signer who signed the servers certificate. These certificates are usually valid for many years hence should reduce the maintenance effort. But still you have to import the full chain of the signers.  Using the retreive signers from port ( https://www.ibm.com/support/knowledgecenter/en/SS7JFU_8.5.5/com.ibm.websphere.express.doc/ae/tsec_sslretrievesignersport.html ) might help here.

Hope that helps. Please let me know if you have further qustions - Hermann

#ibmchampion

------------------------------
Hermann Huebler
------------------------------