IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

This
test
certificate
is
not
suitable
for
permanent
use
by
the
WebSEAL
server.
Although
this
test
certificate
allows
WebSEAL
to
respond
to
an
SSL-enabled
browser
request,
it
cannot
be
verified
by
the
browser.
This
is
because
the
browser
does
not
contain
an
appropriate
root
CA
certificate
—
as
is
the
case
for
when
the
browser
receives
any
self-signed
certificate
for
which
a
root
CA
certificate
does
not
exist.
Because
the
private
key
for
this
default
certificate
is
contained
in
every
WebSEAL
distribution,
this
certificate
offers
no
true
secure
communication.
To
ensure
secure
communication
over
SSL,
WebSEAL
administrators
must
obtain
a
unique
site
server
certificate
from
a
trusted
Certificate
Authority
(CA).
You
can
use
the
GSKit
iKeyman
utility
to
generate
a
certificate
request
that
is
sent
to
the
CA.
You
can
also
use
iKeyman
to
install
and
label
the
new
site
certificate.
Use
the
webseal-cert-keyfile-label
parameter
in
the
[ssl]
stanza
of
the
WebSEAL
configuration
file
to
designate
the
certificate
as
the
active
WebSEAL
server-side
certificate
(this
setting
overrides
any
certificate
designated
as
“default”
in
the
keyfile
database).
If
you
require
different
certificates
for
other
scenarios
(such
as
for
mutually
authenticated
junctions),
you
can
use
the
iKeyman
utility
to
create,
install,
and
label
these
additional
certificates.
See
“Configuring
WebSEAL
key
database
parameters”
on
page
229.
It
is
also
important
to
ensure
that
validation
of
certificates
includes
checking
of
Certificate
Revocation
Lists
(CRLs).
Configure
WebSEAL
to
access
the
appropriate
LDAP
server
as
an
LDAP
user
with
sufficient
permission
to
access
the
appropriate
CRLs.
Supply
values
for
the
following
configuration
file
entries:
[ssl]
crl-ldap-server
crl-ldap-server-port
crl-ldap-user
crl-ldap-user-password
WebSEAL
can
be
configured
to
cache
CRLs.
To
configure
the
cache,
supply
values
for
the
following
configuration
file
entries:
[ssl]
gsk-crl-cache-size
gsk-crl-cache-entry-lifetime
Instructions
for
setting
values
that
affect
CRL
access
and
handling,
including
valid
ranges
for
cache
settings,
are
specified
in
the
“Secure
Socket
Layer”
on
page
406
section.
See
also
“Configuring
the
CRL
cache”
on
page
231.
Enabling/disabling
HTTPS
access
Enable
or
disable
HTTPS
access
during
WebSEAL
configuration:
https
=
{yes|no}
Setting
the
HTTPS
access
port
value
The
default
port
for
HTTPS
access
is
443:
https-port
=
443
To
change
to
port
4343,
for
example,
set:
https-port
=
4343
Chapter
2.
WebSEAL
server
configuration
29