Managing and Replacing WebSphere 6.1 SSL Certificates

Transcription

1 IBM Software Group Managing and Replacing WebSphere 6.1 SSL Certificates Brett Ostrander WebSphere Support Technical Exchange

2 Agenda Basic Design / Overview Default 6.1 Configuration Scope Settings Certificate Expiration Management Manually Replacing Certificates

3 Basic Design / Overview No longer use the Dummy keys Key Stores (key.p12) and Trust Stores (trust.p12) contain Signer Certificates Personal Certificates Personal Certificate Requests WebSphere provides all of the needed key/trust stores needed by default Self signed certificates are created per profile by default

4 Basic Design / Overview Certificate and key management is built into the Admin Console Configurations are scoped at the level of cell, node, cluster, node group, server...

5

6 Default Configuration Key Stores and Trust Stores are managed via the Admin Console and stored in the configuration repository CellDefaultKeyStore is located in ${CONFIG_ROOT}/cells/cell_name/key.p12 CellDefaultTrustStore is located in ${CONFIG_ROOT}/cells/cell_name/trust.p12 Important: This is the Trust Store used by default in the Entire Cell

7 Default Configuration NodeDefaultKeyStore is in ${CONFIG_ROOT}/cells/cell_name/nodes/node_name/key.p12 NodeDefaultTrustStore is in ${CONFIG_ROOT}/cells/cell_name/nodes/node_name/trust.p1 2 NodeDefaultTrustStore is not used by default

8 Default Configuration Web Server s KDB file is in ${CONFIG_ROOT}/config/cells/cell_name/nodes/node_name/ servers/webserver/plugin-key.kdb

9 Scope Settings

10 SSL configurations > NodeDefaultSSLSettings

11 Certificate Expiration Management WebSphere automatically (be default) scans all key stores looking for certificates that will expire Any self-signed certificates that will expire in the next expiration notification days will be replaced if automatic synchronization is disabled and outage will occur unmanaged webservers stop working communication may be broken with other servers in other cells, MQ, etc. various other problems can also occur Consider disabling automatic certificate replacement and generating your own certificates...

12

13 Manually Replacing Certificates Run backupconfig on the Deployment Manager Replace the Deployment Manager certificate In the Admin Console, go to Security > SSL certificate and key management > Key stores and certificates > CellDefaultKeyStore > Personal certificates > Create a self-signed certificate

14 Enter the required attributes and Save the changes.

15 Return to Security > SSL certificate and key management > Key stores and certificates > CellDefaultKeyStore > Personal certificates Select the old certificate and Replace

16 Accept your new certificate and Save

17 On the next screen, select the old certificate and Delete

18 Verify that a Signer Certificate was added to your CellDefaultTrustStore for your new personal certificate

19

20 If for any reason the Signer Certificate was not added then you can do this manually

21 Select the CellDefaultKeyStore and the CellDefaultTrustStore and click Exchange signers...

22 Select and Add the new Signer Certificate

23 Manually Replacing Certificates Replace the Node certificate Go to Security > SSL certificate and key management > Manage endpoint security configurations and Select the node

24 Select Manage certificates

25 Create a new self-signed certificate

26 Enter the required attributes and Save the changes

27 Return to Security > SSL certificate and key management > Manage endpoint security configurations and Select the node Select Manage Certificates Select the old certificate and click Replace

28 Accept your new certificate and Save

29 Return to the node Manage certificates page, select the old certificate and Delete

30 Verify that a Signer Certificate was added to your CellDefaultTrustStore for your new Personal Certificate

31

32 If for any reason the Signer Certificate was not added then you can do this manually Select the NodeDefaultKeyStore and the CellDefaultTrustStore and click Exchange signers...

33 Select and Add the new Signer Certificate

34 Manually Replacing Certificates Delete the old Signer Certificates and Extract the new ones

35

36 Extract each certificate

37 Enter a File Name that corresponds to the certificate. For example, node1.arm These files are saved to the profile_root/dmgr/etc directory

38 Manually Replacing Certificates Add the Signer Certificates for each node to the plugin-key.kdb Go to Servers > Web servers> webserver_name > Plug-in properties > Manage keys and certificates > Signer certificates > Add

39 Enter a unique Alias Name and then specify the File Name that you created previously

40 Repeat this for each of the new certificates (the cell signer and all of the node signers) Manually copy the plugin-key.kdb from the local configuration to the webserver Important Note: Depending on your configuration you may not be able to perform the previous steps with the console. If the fields are greyed out and/or you are unable to manage your plugin-key.kdb from the console you will need to use IKEYMAN to manually add the certificates

41 Manually Replacing Certificates For all profiles, when these self-signed certificates are initially created they are also added into the key.p12 and trust.p12 in the ${PROFILE_ROOT}/etc directory. These key stores are used by clients (for example, wsadmin) started from this profile These certificates provide them with the trust needed to communicate with servers in the same profile without requiring any signer exchanges to occur

42 Manually Replacing Certificates Whenever changes are made to the server certificates after the initial profile creation the /etc trust.p12 will need to be updated If client authentication is enabled on the server the /etc/key.p12 will need be updated also

43 Manually Replacing Certificates Manually replace the trust.p12 in each of the /etc directories Copy the ${CONFIG_ROOT}/cells/cell_name/trust.p12 to the profile_root/dmgr/etc directory Copy the ${CONFIG_ROOT}/cells/cell-name/trust.p12 to the profile_root/appsrv/etc directory and repeat for each node in the cell If needed, replace the key.p12 files also Copy the ${CONFIG_ROOT}/cells/cell_name/key.p12 to the profile_root/dmgr/etc directory Copy the ${CONFIG_ROOT}/cells/cellname/node/node_name/key.p12 to corresponding profile_root/appsrv/etc directory and repeat for each node in the cell

44 Reference Articles IBM WebSphere Developer Technical Journal: SSL, certificate, and key management enhancements for even stronger security in WebSphere Application Server V6.1 Manually Replacing SSL Certificates in V6.1

45 IBM Software Group Additional WebSphere Product Resources Discover the latest trends in WebSphere Technology and implementation, participate in technically-focused briefings, webcasts and podcasts at: Learn about other upcoming webcasts, conferences and events: Join the Global WebSphere User Group Community: Access key product show-me demos and tutorials by visiting IBM Education Assistant: View a Flash replay with step-by-step instructions for using the Electronic Service Request (ESR) tool for submitting problems electronically: Sign up to receive weekly technical My support s: WebSphere Support Technical Exchange 45

46 IBM Software Group Questions and Answers WebSphere Support Technical Exchange 46