Configuring a hardware cryptographic keystore

You can create a hardware cryptographic keystore that WebSphere® Application Server can use to provide cryptographic token support in the server configuration.

1. Click Security > SSL certificate and key management > Key stores and certificates.
2. Click New.
3. Type a name to identify the keystore.
   This name is used to enable hardware cryptography in the Web Services Security configuration.
4. Optionally, you can type a description for the keystore in the Description field.
5. You can specify a Management scope for the key store. This is not required.
   The management scope specifies the scope where this Secure Sockets Layer (SSL) configuration is visible. For example, if you choose a specific node, then the configuration is only visible on that node and any servers that are part of that node.
6. Type the path for the hardware device-specific configuration file.
   The configuration file is a text file that contains entries in the following format: attribute = value. The valid values for attribute and value are described in detail in the Software Developer Kit, Java™ Technology Edition documentation. The two mandatory attributes are name and library, as shown in the following sample code:

   name = FooAccelerator
   library = /opt/foo/lib/libpkcs11.so
   slotListIndex = 0

   The configuration file should also include device-specific configuration data. Navigate to the PKCS11ImplConfigSamples.jar file, which contains sample configuration files, in the IBM SDK documentation.

   Note: JSSE2 is unable to use the IBMPKCS11Impl provider for acceleration.

   1. You can use this link http://www-01.ibm.com/docs/SSYKE2_5.0.0/com.ibm.java.security.component.doc.50/secguides/pkcs11implDocs/IBMJavaPKCS11ImplementationProvider.html to initialize the IBMPKCS11 provider in a thread safe way
   2. Specify a unique .cfg file that contains information about the supported hardware device. A list of supported hardware devices are available at http://www-01.ibm.com/docs/SSYKE2_5.0.0/com.ibm.java.security.component.doc.50/secguides/pkcs11implDocs/IBMPKCS11SupportList.html.
   3. You specify the Signature.getInstance method with the properly initialized IBMPKCS11Impl provider instance as shown.

      Signature.getInstance("SHA1withRSA", ibmpkcs11implinstance);

7. Type a password if the token login is required.
   Operations that use keys on the token require a secure login. This field is optional if the keystore is used as a cryptographic accelerator. In this case, you need to select Enable cryptographic operations on hardware device.
8. Select the PKCS11 type.
9. Select Read only.
10. Click OK and Save.