Signer certificates are added to a keystore on the client
side of an SSL communication to establish trust with the server. There
is common practice for keystores to have trust established when they
are created. The DmgrDefaultSignersStore on a deployment manager
and the NodeDefaultSignersStore on a stand alone application
server are created to hold signer certificates used to establish trust
by default in newly create keystores.
Before you begin
The default signers key store is created during profile creation
and contains the signer certificate of the server default root certificate.
Additional signer certificates can be added to the default signers
key store at any time. Anytime a keystore is created using the admin
console or by using the createKeyStore AdminTask object in
scripting, all signer certificates from the default signer store are
added to the newly created keystore.Alternative Method:
- To add a signer certificate to a default signer keystore by using
the wsadmin tool, use the addSignerCertificate command of the
AdminTask object.
- To create a new keystore by using the wsadmin tool, use the createKeyStore command
of the AdminTask object.
- To extract the signer from a personal certificate using the wsadmin
tool, use the extractCertificate of the AdminTask object.
- To exchange a signer certificate using the wsadmin tool, use the KeyStoreCommands command
group for the AdminTask object.
For more information, see the SignerCertificateCommands command
group for the AdminTask object article and the KeyStoreCommands command
group for the AdminTask object article.
Procedure
- If the certificate is in a certificate file, it can be
added to the default signer keystore using the administrative console.
- Click .
- Under Related Items, click Key stores and certificates.
- c. Select Default signers keystore under KeyStore Usages. A
panel displaying a list of keystores appears.
- Click on DmgrDefaultSignersStore.
- Under Additional Properties, click Signer certificates.
- Click Add .
- Enter an alias in the alias box, a path to the certificate file in the filename box,
and an asterisk (•). Select the format of the certificate file from the pull down list in the
Data typebox.
- Click Apply then Save.
Note: You can also perform this addition using the AdminTask, addSignerCertificate.
- If the signer certificate form of a personal certificate
needs to be added to default signers keystore, you can extract the
signer from the personal certificate to a certificate file or the
signer can be extracted directly to the default signers keystore.
To extract a signer certificate from a personal certificate to a
certificate file,
- Click Security > SSL certificate and key management.
- Under Related Items, click Key stores and certificates.
- c. Select All under Keystore Usages. A panel displaying a list
of keystores appears.
- Click on the keystore name
- Under Additional Properties, click Personal certificates.
- Select a personal certificate.
- Click Extract.
- Enter the path to the certificate file in Certificate file name
box and select a format type from the pull down list in Data type
box
- Click Apply then Save.
- The signer can be added to the default signers keystore
by following step 1.
Note: You can also extract the signer from a personal certificate
using scripting and the AdminTask extractCertificate.
- To extract a signer certificate to the default signers
keystore, an exchange of the signer certificate can be performed from
the administrative console.
- Click Security > SSL certificate and key management
- Under Related Items, click Key stores and certificates.
- c. Select All under Keystore Usages. A panel displaying a list
of keystores appears.
- Click on the default signers keystore and the keystore
that contains the personal certificate whose signer certificate is
needed.
- Click Exchange Signers.
- Select the personal certificate whose signer is needed.
- Click Add.
- Click Apply then Save.
Note: You can also perform the exchange using the AdminTask, exchangeSigner.
Results
When these steps are completed, the signer from the certificate
file is stored in the default signers keystore. You can see the signer
in the keystore files list of signer certificates.
What to do next
The new keystore will contain the default signers that were
added to the default signers keystore.