Creating a key database file with a self-signed certificate

Edit online

Create a self-signed certificate for the key database to test public/private key for a public key and signature algorithm before you replace them with CA certificates.

Before you begin

To create key database file, the following requirements must be met:

  • Log in to the computer as a root user on AIX® and Linux™ , and as an administrative member on Microsoft™ Windows™.
  • To create a CMS key database for a directory server, your computer with the server must contain GSKit, Version 9.0.0.8.
  • To create a JKS key database, your computer with the Web Administration Tool must contain IBM® Semeru Runtime Certified Edition Version 17 SR 0 or later.

For more information, see the Key database, Certificate, and Certificate request chapters in the GSKit tool gsk9certutil_64 user guide GSK9_CertUtil_User_Guide../v11/documents/GSK_CertUtil_UserGuide.pdf.

For more information about using the keytool utility, refer to: https://www.ibm.com/docs/en/sdk-java-technology/8?topic=guide-keytool documentation website.

About this task

If your computer contains GSKit 32-bit, use the gsk9capicmd command. If your computer contains GSKit 64-bit, use the gsk9capicmd_64 command. When you complete the task, the key database file contains the following data:
  • A CMS key database file with signer certificate extracted from a JKS key database file.
  • A JKS key database file with signer certificate extracted from a CMS key database file.

Procedure

  1. To create a CMS key database with self-signed certificate, complete the following steps:
    1. Log in to the computer with the required privileges.
    2. To create a CMS key database, run the gsk9capicmd_64 command in the following format:
      gsk9capicmd_64 -keydb -create -db serverkey.kdb -pw serverpwd 
 -type cms -expire 1000 -stash -fips
    3. To create a self-signed certificate with key size 2048 and signature algorithm SHA512WithRSA, run the gsk9capicmd_64 command in the following format:
      gsk9capicmd_64 -cert -create -db serverkey.kdb -pw serverpwd -label serverlabel 
 -dn "cn=LDAP_Server,o=sample" -size 2048 -default_cert yes -sigalg SHA512WithRSA
    4. To extract the certificate data from the key database, run the gsk9capicmd_64 command in the following format:
      gsk9capicmd_64 -cert -extract -db serverkey.kdb -pw serverpwd -label serverlabel 
 -target server.der -format binary
    5. Transfer the file with the extracted certificate from a CMS key database to the computer with Web Administration Tool.
  2. To create a JKS key database with self-signed certificate, complete the following steps:
    1. Log in to the computer with the required privileges.
    2. Set the JAVA_HOME and PATH variables with the IBM Semeru Runtime Certified Edition location that is provided with IBM Verify Directory.
      AIX
      export JAVA_HOME=/opt/IBM/ldap/V11.0.1/java
export PATH=/opt/IBM/ldap/V11.0.1/java/jre/bin:$PATH
      Linux
      export JAVA_HOME=/opt/ibm/ldap/V11.0.1/java
export PATH=/opt/ibm/ldap/V11.0.1/java/jre/bin:$PATH
      Windows
      set JAVA_HOME=C:\Program Files\IBM\ldap\V11.0.1\java
set PATH=C:\Program Files\IBM\ldap\V11.0.1\java\jre\bin:%PATH%
    3. To create a JKS key database along with self-signed certificate(key pair), run the keytool command in the following format: 
      keytool -genkeypair -alias webadminlabel -dname "cn=LDAP_WebAdmin,o=sample"
 -keystore webadminkey.jks -keypass webadminpwd -keyalg RSA -storepass webadminpwd -keysize 2048
    4. To extract the certificate data from the key database, run the keytool command in the following format: 
      keytool -exportcert -keypass webadminpwd -keystore webadminkey.jks 
 -storepass webadminpwd -file webadmin.der -alias webadminlabel
    5. Transfer the file with the extracted certificate from a JKS key database to the computer with directory server instance.
  3. On the computer with directory server instance, add the extracted certificate from a JKS key database to the CMS key database.
    gsk9capicmd_64 -cert -add -db serverkey.kdb -pw serverpwd -label webadminlabel 
 -file webadmin.der -format binary
  4. On the computer with Web Administration Tool, add the extracted certificate from a CMS key database to the JKS key database.
    keytool -importcert -keystore webadminkey.jks -storepass webadminpwd 
 -alias serverlabel -keypass webadminpwd -file server.der

What to do next

To continue with the configuration, complete the following steps: