IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
File<br />
Type<br />
Description<br />
.rdb<br />
The<br />
″request″<br />
database<br />
file.<br />
Automatically<br />
created<br />
when<br />
you<br />
create<br />
a<br />
.kdb<br />
key<br />
database<br />
file.<br />
The<br />
stem<br />
name<br />
of<br />
this<br />
file<br />
is<br />
the<br />
same<br />
as<br />
the<br />
associated<br />
.kdb<br />
file.<br />
This<br />
file<br />
contains<br />
certificate<br />
requests<br />
that<br />
are<br />
outstanding<br />
and<br />
have<br />
not<br />
yet<br />
been<br />
received<br />
back<br />
from<br />
the<br />
CA.<br />
When<br />
a<br />
certificate<br />
is<br />
returned<br />
from<br />
the<br />
CA,<br />
the<br />
.rdb<br />
file<br />
is<br />
searched<br />
<strong>for</strong><br />
the<br />
matching<br />
certificate<br />
request<br />
(based<br />
on<br />
the<br />
public<br />
key).<br />
If<br />
a<br />
match<br />
is<br />
found,<br />
the<br />
certificate<br />
is<br />
received<br />
and<br />
the<br />
corresponding<br />
certificate<br />
request<br />
is<br />
deleted<br />
from<br />
the<br />
.rdb<br />
file.<br />
If<br />
a<br />
match<br />
is<br />
not<br />
found,<br />
the<br />
attempt<br />
to<br />
receive<br />
the<br />
certificate<br />
is<br />
rejected.<br />
Included<br />
in<br />
the<br />
certificate<br />
request<br />
is<br />
the<br />
common<br />
name,<br />
organization,<br />
street<br />
address,<br />
and<br />
other<br />
in<strong>for</strong>mation<br />
that<br />
was<br />
specified<br />
at<br />
the<br />
time<br />
of<br />
the<br />
request,<br />
as<br />
well<br />
as<br />
the<br />
public<br />
and<br />
private<br />
key<br />
associated<br />
with<br />
the<br />
request.<br />
.crl<br />
The<br />
″certificate<br />
revocation<br />
list″<br />
file.<br />
This<br />
file<br />
normally<br />
contains<br />
the<br />
list<br />
of<br />
certificates<br />
that<br />
have<br />
been<br />
revoked<br />
<strong>for</strong><br />
one<br />
reason<br />
or<br />
another.<br />
However,<br />
iKeyman<br />
does<br />
not<br />
provide<br />
any<br />
support<br />
<strong>for</strong><br />
certificate<br />
revocation<br />
lists,<br />
so<br />
it<br />
is<br />
empty.<br />
.arm<br />
An<br />
ASCII<br />
encoded<br />
binary<br />
file.<br />
A<br />
.arm<br />
file<br />
contains<br />
a<br />
base-64<br />
encoded<br />
ASCII<br />
representation<br />
of<br />
a<br />
certificate,<br />
including<br />
its<br />
public<br />
key,<br />
but<br />
not<br />
its<br />
private<br />
key.<br />
The<br />
original<br />
binary<br />
certificate<br />
data<br />
is<br />
trans<strong>for</strong>med<br />
into<br />
an<br />
ASCII<br />
representation.<br />
When<br />
a<br />
user<br />
receives<br />
a<br />
certificate<br />
in<br />
a<br />
.arm<br />
file,<br />
iKeyman<br />
decodes<br />
the<br />
ASCII<br />
representation<br />
and<br />
places<br />
the<br />
binary<br />
representation<br />
into<br />
the<br />
appropriate<br />
.kdb<br />
file.<br />
Similarly,<br />
when<br />
a<br />
user<br />
extracts<br />
a<br />
certificate<br />
from<br />
a<br />
.kdb<br />
file,<br />
iKeyman<br />
converts<br />
the<br />
data<br />
from<br />
binary<br />
to<br />
ASCII<br />
and<br />
places<br />
it<br />
in<br />
a<br />
.arm<br />
file.<br />
Note:<br />
Any<br />
file<br />
extension<br />
is<br />
acceptable<br />
to<br />
use<br />
(other<br />
than<br />
.arm),<br />
as<br />
long<br />
as<br />
the<br />
file<br />
itself<br />
is<br />
a<br />
Base64<br />
encoded<br />
file.<br />
.der<br />
The<br />
″Distinguished<br />
Encoding<br />
Rules″<br />
file.<br />
A<br />
.der<br />
file<br />
contains<br />
a<br />
binary<br />
representation<br />
of<br />
a<br />
certificate,<br />
including<br />
its<br />
public<br />
key,<br />
but<br />
not<br />
its<br />
private<br />
key.<br />
It<br />
is<br />
very<br />
similar<br />
to<br />
a<br />
.arm<br />
file,<br />
except<br />
that<br />
the<br />
representation<br />
is<br />
binary,<br />
not<br />
ASCII.<br />
.p12<br />
The<br />
″PKCS<br />
12″<br />
file,<br />
where<br />
PKCS<br />
stands<br />
<strong>for</strong><br />
″Public-Key<br />
Cryptography<br />
Standards″.<br />
A<br />
.p12<br />
file<br />
contains<br />
a<br />
binary<br />
representation<br />
of<br />
a<br />
certificate,<br />
including<br />
both<br />
its<br />
public<br />
and<br />
private<br />
keys.<br />
A<br />
.p12<br />
file<br />
may<br />
also<br />
include<br />
more<br />
than<br />
one<br />
certificate;<br />
<strong>for</strong><br />
example,<br />
a<br />
certificate<br />
chain.<br />
Because<br />
a<br />
.p12<br />
file<br />
contains<br />
a<br />
private<br />
key,<br />
it<br />
is<br />
password<br />
protected.<br />
Configuring<br />
<strong>WebSEAL</strong><br />
key<br />
database<br />
parameters<br />
<strong>WebSEAL</strong><br />
Key<br />
Database<br />
File:<br />
At<br />
installation,<br />
<strong>WebSEAL</strong><br />
provides<br />
a<br />
default<br />
certificate<br />
key<br />
database.<br />
The<br />
webseal-cert-keyfile<br />
parameter,<br />
located<br />
in<br />
the<br />
[ssl]<br />
stanza<br />
of<br />
the<br />
webseald.conf<br />
configuration<br />
file,<br />
identifies<br />
the<br />
name<br />
and<br />
location<br />
of<br />
this<br />
file:<br />
[ssl]<br />
webseal-cert-keyfile<br />
=<br />
/var/pdweb/www/certs/pdsrv.kdb<br />
You<br />
can<br />
use<br />
the<br />
iKeyman<br />
utility<br />
to<br />
create<br />
a<br />
new<br />
key<br />
database.<br />
However,<br />
you<br />
must<br />
enter<br />
the<br />
name<br />
and<br />
location<br />
of<br />
this<br />
new<br />
key<br />
file<br />
in<br />
the<br />
webseal-cert-keyfile<br />
parameter<br />
so<br />
that<br />
<strong>WebSEAL</strong><br />
can<br />
find<br />
and<br />
use<br />
the<br />
certificates<br />
contained<br />
in<br />
that<br />
database.<br />
Key<br />
Database<br />
File<br />
Password:<br />
At<br />
installation,<br />
<strong>WebSEAL</strong><br />
also<br />
provides<br />
a<br />
default<br />
stash<br />
file<br />
that<br />
contains<br />
the<br />
password<br />
<strong>for</strong><br />
the<br />
pdsrv.kdb<br />
key<br />
file.<br />
The<br />
webseal-cert-keyfile-stash<br />
parameter<br />
in<strong>for</strong>ms<br />
<strong>WebSEAL</strong><br />
of<br />
the<br />
location<br />
of<br />
the<br />
stash<br />
file:<br />
webseal-cert-keyfile-stash<br />
=<br />
/var/pdweb/www/certs/pdsrv.sth<br />
The<br />
default<br />
password<br />
encrypted<br />
in<br />
this<br />
stash<br />
file<br />
is<br />
″pdsrv″.<br />
You<br />
can<br />
also<br />
express<br />
a<br />
password<br />
as<br />
plain<br />
text<br />
in<br />
the<br />
webseal-cert-keyfile-pwd<br />
parameter.<br />
For<br />
example:<br />
webseal-cert-keyfile-pwd<br />
=<br />
pdsrv<br />
Chapter<br />
8.<br />
<strong>WebSEAL</strong><br />
Key<br />
Management<br />
229