IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

v
Create
one
or
more
key
databases
v
Change
key
database
passwords
v
Create
new
WebSEAL
certificates
v
Set
a
new
default
WebSEAL
certificate
v
Create
a
self-signed
certificate
for
testing
v
Request
and
receive
CA
root
certificates
v
Add
certificates
to
and
delete
certificates
from
the
database
v
Copy
certificates
from
one
database
to
another
Refer
to
the
Secure
Sockets
Layer
Introduction
and
iKeyman
User’s
Guide
for
detailed
information
on
using
the
iKeyman
utility.
Configuring
CRL
checking
The
Certificate
Revocation
List
(CRL)
is
a
method
of
preventing
the
validation
of
unwanted
certificates.
The
CRL
contains
the
identities
of
certificates
that
are
deemed
untrustworthy.
The
GSKit
implementation
of
SSL
used
by
WebSEAL
supports
CRL
checking.
GSKit
allows
WebSEAL
to
perform
CRL
checking
on
client-side
certificates
and
certificates
from
SSL
junctions.
WebSEAL
must
know
the
location
of
this
list
in
order
to
perform
CRL
checking.
Parameters
for
the
location
of
the
LDAP
server
that
can
be
referenced
for
CRL
checking
during
client-side
certificate
authentication
are
found
in
the
[ssl]
stanza
of
the
webseald.conf
configuration
file:
[ssl]
#crl-ldap-server
=
#crl-ldap-server-port
=
#crl-ldap-user
=
#crl-ldap-user-password
=
Parameters
for
the
location
of
the
LDAP
server
that
can
be
referenced
for
CRL
checking
during
authentication
across
SSL
junctions
are
found
in
the
[junction]
stanza
of
the
webseald.conf
configuration
file:
[junction]
#crl-ldap-server
=
#crl-ldap-server-port
=
#crl-ldap-user
=
#crl-ldap-user-password
=
By
default,
CRL
checking
is
disabled
(parameters
are
commented
out).
To
enable
CRL
checking
during
certificate
authentication,
uncomment
each
parameter
and
enter
the
appropriate
values.
A
null
value
for
the
crl-ldap-user
indicates
that
the
SSL
authentication
mechanism
should
bind
to
the
LDAP
server
as
an
anonymous
user.
Configuring
the
CRL
cache
GSKit
allows
WebSEAL
to
perform
CRL
checking
on
client-side
certificates
and
certificates
from
SSL
junctions.
To
improve
CRL
checking
performance,
you
can
cache
the
CRL
from
a
particular
Certificate
Authority
(CA).
Subsequent
CRL
checks
are
made
against
this
cached
version
of
the
list.
The
settings
for
the
two
webseald.conf
configuration
file
parameters
discussed
in
this
section
are
passed
directly
to
the
GSKit
utility.
For
further
information
about
GSKit
functionality,
refer
to
the
GSKit
documentation.
Chapter
8.
WebSEAL
Key
Management
231