IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Chapter 8.
WebSEAL
Key
Management
This chapter contains information that describes tasks you can perform to manage
certificate handling by the WebSEAL server.
Topic Index:
v
v
“WebSEAL Key Management Overview” on page 227
“Managing client-side and server-side certificates” on page 228
WebSEAL Key Management Overview
© Copyright IBM Corp. 1999, 2003
The following diagram summarizes the key management configuration required
for SSL communication between WebSEAL and other components of the Tivoli
Access Manager domain. Configuration stanzas and parameters are located in the
WebSEAL configuration file. The GSKit iKeyman utility is used to create key
database files and manage the digital certificates stored in these key database files.
Client WebSEAL
(WebSEAL authenticates to client)
[ssl]
webseal-cert-keyfile-label
Key stored in pdsrv.kdb
Figure 7. Keyfile management parameters
-K junction
LDAP
registry
Policy
database
XKMS
Application
Server
(WebSEAL authenticates to LDAP)
[ldap]
ssl-keyfile-dn
Certificate specified during installation
Custom keyfile database created with
iKeyman
(mutually authenticated
SSL junctions)
-K ""
Key stored in pdsrv.kdb
(WebSEAL authenticates to Policy Server)
[ssl]
ssl-keyfile-label
Key stored in webseald.kdb
(WebSEAL authenticates to
VeriSign XKMS Service)
[xkms-jniimpl]
xkms.verisignimpl.keystore
xkms.verisignimpl.privateKeyAlias
Keys obtained from VeriSign
227