Adding a CA certificate, or the public part of a self-signed certificate, into a key repository on UNIX, Linux, and Windows
Follow this procedure to add a CA certificate or the public part of a self-signed certificate to the key repository.
If the certificate that you want to add is in a certificate chain, you must also add all the certificates that are above it in the chain. You must add the certificates in strictly descending order starting from the root, followed by the CA certificate immediately below it in the chain, and so on.
Where the following instructions refer to a CA certificate, they also apply to the public part of a self-signed certificate.
Using strmqikm
If you need to manage TLS certificates in a way that is FIPS compliant, use the runmqakm command. strmqikm does not provide a FIPS-compliant option.
Perform the following steps on the machine on which you want to add the CA certificate:
- Start the GUI using the strmqikm command (on UNIX, Linux® and Windows systems).
- From the Key Database File menu, click Open. The Open window opens.
- Click Key database type and select CMS (Certificate Management System).
- Click Browse to navigate to the directory that contains the key database files.
- Select the key database file to which you want to add the certificate, for example
key.kdb
. - Click OK. The Password Prompt window opens.
- Type the password you set when you created the key database and click OK. The name of your key database file displays in the File Name field.
- In the Key database content field, select Signer Certificates.
- Click Add. The Add CA's Certificate from a File window opens.
- Type the certificate file name and location where the certificate is stored, or click Browse to select the name and location.
- Click OK. The Enter a Label window opens.
- In the Enter a Label window, type the name of the certificate.
- Click OK. The certificate is added to the key database.
Using the command line
- Using runmqckm:
runmqckm -cert -add -db filename -pw password -label label -file filename -format ascii
- Using runmqakm:
runmqakm -cert -add -db filename -pw password -label label -file filename -format ascii -fips
- -db filename
- Specifies the fully qualified file name of the CMS key database.
- -pw password
- Specifies the password for the CMS key database.
- -label label
- Specifies the label attached to the certificate.
- -file filename
- Specifies the name of the file containing the certificate.
- -format ascii
- Specifies the format of the certificate. The value can be
ascii
for Base64-encoded ASCII orbinary
for Binary DER data. The default isascii
.
- -fips
- Specifies that the command is run in FIPS mode. When in FIPS mode, the ICC component uses algorithms that have been FIPS 140-2 validated. If the ICC component does not initialize in FIPS mode, the runmqakm command fails.