IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Managing
client-side
and
server-side
certificates
This
section
describes
the
administration
and
configuration
tasks
required
to
set
up
WebSEAL
to
handle
client-side
and
server-side
digital
certificates
used
for
authentication
over
SSL.
WebSEAL
requires
certificates
for
the
following
situations:
v
WebSEAL
identifies
itself
to
SSL
clients
with
its
server-side
certificate
v
WebSEAL
identifies
itself
to
a
junctioned
back-end
server
(configured
for
mutual
authentication)
with
a
client-side
certificate
v
WebSEAL
refers
to
its
database
of
Certificate
Authority
(CA)
root
certificates
to
validate
clients
accessing
with
client-side
certificates
v
WebSEAL
refers
to
its
database
of
Certificate
Authority
(CA)
root
certificates
to
validate
junctioned
back-end
servers
WebSEAL
uses
the
IBM
Global
Security
Kit
(GSKit)
implementation
of
SSL
to
configure
and
administer
digital
certificates.
GSKit
provides
the
iKeyman
utility
to
set
up
and
manage
the
certificate
key
database
that
contains
one
or
more
WebSEAL
server/client
certificates
and
the
CA
root
certificates.
WebSEAL
includes
the
following
components
at
installation
to
support
SSL
authentication
using
digital
certificates:
v
A
default
key
database
(pdsrv.kdb)
v
A
default
key
database
stash
file
(pdsrv.sth)
and
password
(″pdsrv″)
v
Several
common
CA
root
certificates
v
A
self-signed
test
certificate
that
WebSEAL
can
use
to
identify
itself
to
SSL
clients
It
is
recommended
that
you
apply
for
a
commonly
recognized
certificate
from
a
known
Certificate
Authority
to
replace
this
test
certificate.
Configuration
for
WebSEAL
certificate
handling
includes:
v
“Configuring
WebSEAL
key
database
parameters”
on
page
229
v
“Using
the
iKeyman
certificate
management
utility”
on
page
230
v
“Configuring
CRL
checking”
on
page
231
GSKit
key
database
file
types
The
IBM
Key
Management
tool
(iKeyman)
uses
several
file
types
that
are
summarized
in
the
following
table.
A
CMS
key
database
consists
of
a
file
with
the
extension
.kdb
and
possibly
two
or
more
other
files.
The
.kdb
file
is
created
when
you
create
a
new
key
database.
A
key
record
in
a
.kdb
file
can
be
either
a
certificate
or
a
certificate
with
its
encrypted
private
key
information.
The
.rdb
and
.crl
files
are
created
when
you
create
a
new
certificate
request.
The
.rdb
file
is
required
throughout
the
CA
certificate
request
process.
File
Type
Description
.kdb
The
″key
database″
file.
Stores
personal
certificates,
personal
certificate
requests,
and
signer
certificates.
For
example,
the
default
WebSEAL
key
database
file
is
pdsrv.kdb.
.sth
The
″stash″
file.
Stores
an
obfuscated
version
of
the
key
database
password.
The
stem
name
of
this
file
is
the
same
as
the
associated
.kdb
file.
Also
stores
private
keys,
if
there
are
any.
228
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide