Server certificate from an external Certificate Authority (CA)

Edit online

You can use the steps provided here to secure a Server certificate from an external Certificate Authority (CA).

About this task

In order to provide a secure connection between IBM® Security Verify Directory and its clients, the server must have an X.509 certificate and a private key.

The steps required to generate a private key, obtain the required server certificate from an external CA, and prepare them for use by IBM Security Verify Directory are outlined in the following steps:

Procedure

  1. Logon as administrator or root. Note: If the administrator DN which was created during the server configuration process was cn=root, then enter the full administrator DN. Do not just use root.
  2. Change to the directory where you want to create the key database file and where your private key and certificate will be stored.
  3. Run ikeyman to create a new key database file. You can use any valid value for the key database file name that you want. Whatever file name you use, you need to provide it when configuring the LDAP server to use SSL. Consider providing a full path name. The ikeyman utility is used to generate a private-public key pair and a certificate request. See The iKeyman tool for additional information.Note: By default, the new KDB created by GSKit is not readable by the server. You must change the owner to idsldap.chown idsldap:idsldap <mykeyring>.*. See the Troubleshooting and support section in the IBM Security Verify Directory documentation for a more detailed explanation about the Kerberos service name change.
  4. If VeriSign is your external CA, obtain a certificate from VeriSign, as follows:
    1. Access the following VeriSign Web site: http://www.verisign.com/server/index.html.
    2. Click IBM internet connection servers.
    3. After reviewing the information at this site, click Begin.
    4. Provide the required information and follow the steps required to request your server certificate. VeriSign is the primary Certification Authority supported for obtaining externally generated, high-assurance server certificates.
  5. If you have another CA that you want to use, follow the directions for that CA to submit the contents of the certificate request file to them.

Results

When you receive the resulting certificate from the CA:

  1. Logon using your server identity.
  2. Change to the directory where you created the key database file.
  3. Place the signed certificate from the CA into a file in this directory. The file is used in the next step.
  4. From the same directory, run ikeyman to receive the certificate into your key database file.
  5. Access the LDAP server's Web administrative interface, and configure the various SSL parameters, including the file specification for the key database file. See Using Web Administration.
  6. If you have more than one certificate in the key database file, the certificate you want to use for IBM Security Verify Directory must be the default.
  7. Start IBM Security Verify Directory.
Note: If you instruct ikeyman to save the password in a password stash file, it is not necessary to change or set the password in the ibmslapd.conf file.