Creating a certificate signing request

Edit online

To get a certificate that is signed by a third party, you must create a certificate signing request (CSR) to send to the certificate authority (CA).

Before you begin

The truststore file of the Operations Center is a container for SSL/TLS certificates that the Operations Center can access. The truststore file contains the certificate that the Operations Center uses for HTTPS communication with web browsers.

During the installation of the Operations Center, you create a password for the truststore file. To work with the truststore file, you must know the truststore password. If you do not remember the password, follow the instructions in Deleting and reassigning the password for the Operations Center truststore file.

Procedure

To create a CSR, complete the following steps:

From the operating system command line, change the directory to the keystore location:

installation_dir/ui/Liberty/usr/servers/guiServer

installation_dir\ui\Liberty\usr\servers\guiServer

Create a certificate request by using the the keytool command.
Tip: You might have to specify the full path to the keytool command. The commands are located in the following directory, where installation_dir represents the directory in which the Operations Center is installed:
```
installation_dir/ui/jre/bin
```
```
installation_dir\ui\jre\bin
```
To create a certificate request by using the keytool command, issue the following command:
```
keytool -certreq -keystore gui-truststore.jks -keysize 2048 -sigalg SHA256WithRSA
-dname "CN=myhost.example.com" -file certreq.csr -alias signedcert
-ext "SAN=IP:192.0.2.1,IP:192.0.2.2,DNS:myhost.example.com,DNS:myhost"
```
where:
-dname "CN=myhost.example.com"

Specifies the distinguished name. Specify input as a quoted string that contains the specification CN=myhost.example.com, where myhost.example.com specifies the FQDN of the system on the network where the Operations Center is installed.
Remember: The FQDN for the system on your network is used in the URL for the Operations Center on your system. The URL is used by a web browser to access the Operations Center.

-alias signedcert

Specifies a unique label, signedcert, for the certificate in the truststore file.

-ext

Defines the certificate extension.
SAN=IP:192.0.2.1,IP:192.0.2.2 – Specifies the IP address of the system where the Operations Center is installed. This is an optional parameter.

DNS:myhost.example.com,DNS:myhost – Specifies the domain name server (DNS) names of the system where the Operations Center is installed. The CN and dnsname are typically the same value. This is an optional parameter.
Note: To generate a new key, issue the following command:
```
keytool -genkeypair -alias signedcert -keyalg RSA -keysize 2048 
-keystore gui-truststore.jks -validity 365 -dname "CN=myhost.example.com"
```
When the command prompts for additional details, specify values such as user details and a password for a new key.

What to do next

Sending the certificate signing request to the CA: After you create the certificate request file (certreq.csr), you must send it to the CA for signing. Follow the instructions from the CA.