How to Create Keystore and Truststore for Use by SSL

Below you find an example of how to generate end-to-end automation adapter keystore and the truststore via the Java keytool which resides in the Java SDK of your z/OS Java installation.

You will specify both files, keystore and truststore, in the end-to-end automation SSL configuration file ing.adapter.ssl.properties.

# SMU SSL config file directory
EEZ_CONFIG_DIR=/custom-root/ssl
# Keys will expire in 25 years
KEY_VALIDITY_DAYS=9125
# Passphrase at least 6 characters
PASSPHRASE=passphrase

1. Generate keystore for end-to-end automation z/OS

keytool -genkey -keyalg RSA -validity ${KEY_VALIDITY_DAYS} \
-alias eezadapter -keypass ${PASSPHRASE} -storepass ${PASSPHRASE} \
-dname "cn=E2E Adapter, ou=System Automation, o=IBM, c=US" \
-keystore "${EEZ_CONFIG_DIR}/ing.ssl.adapter.jks"

2. Export Certificate file with public key for end-to-end automation:

${JAVA_KEYTOOL} -export -alias eezadapter \
-file "${EEZ_CONFIG_DIR}/ingadapter.cer" -storepass ${PASSPHRASE} \
-keystore "${EEZ_CONFIG_DIR}/ing.ssl.adapter.jks"

3. Create the truststore that contains the public keys for the end-to-end automation and the Z Automation Web Console

It is assumed that the certificate of the Z Automation Web Console server has the name smuserver.cer and the corresponding alias name is smuserver. Refer to the description of Z Automation Web Console configuration tool in "Security Tab" of Automation Dashboards for Z Automation Web Console Installation and Configuration Guide.

Import the end-to-end automation certificate to the truststore.

${JAVA_KEYTOOL} -import -noprompt -alias eezadapter \
-file "${EEZ_CONFIG_DIR}/ingadapter.cer" -storepass ${PASSPHRASE} \
-keystore "${EEZ_CONFIG_DIR}/ing.ssl.truststore.jks"

Import the Z Automation Web Console certificate to the truststore.

${JAVA_KEYTOOL}-import -noprompt -alias smuserver \
-file "${EEZ_CONFIG_DIR}/smuserver.cer" -storepass ${PASSPHRASE} \
-keystore "${EEZ_CONFIG_DIR}/ing.ssl.truststore.jks"

4. Copy the keystore from step 1 and the truststore from step 3 into the end-to-end automation SSL directory. Update ing.adapter.ssl.properties accordingly.

For more information, refer to Generating Keystore and Truststore with SSL public and private keys in IBM® Tivoli® System Automation Application Manager Installation and Configuration Guide.