Use the WebSphere® Application Server
administrative console to configure trust anchors that specify keystores
which contain trusted root certificates to validate the signer certificate.
Before you begin
Important: There is an important distinction between
Version 5.x and Version 6 and later applications. The information
supports Version 5.x applications only that are used with WebSphere Application Server Version 6.0.x and
later. The information does not apply to Version 6.0.x and
later applications.
This document describes how to configure
trust anchors or trust stores at the application level. It does not
describe how to configure trust anchors at the server or cell level.
Trust anchors defined at the application level have a higher precedence
over trust anchors defined at the server or cell level. For more information
on creating and configuring trust anchors at the server or cell level,
see either Configuring the server security bindings using an assembly tool or Configuring the server security bindings using the administrative console.
You can
configure an application-level trust anchor using an assembly tool
or the administrative console. This document describes how to configure
the application-level trust anchor using the administrative console.
About this task
A trust anchor specifies keystores that contain trusted
root certificates, which validate the signer certificate. These keystores
are used by the request receiver (as defined in the ibm-webservices-bnd.xmi file)
and the response receiver (as defined in the ibm-webservicesclient-bnd.xmi file
when web services are acting as client) to validate the signer certificate
of the digital signature. The keystores are critical to the integrity
of the digital signature validation. If they are tampered with, the
result of the digital signature verification is doubtful and comprised.
Therefore, it is recommended that you secure these keystores. The
binding configuration specified for the request receiver in the ibm-webservices-bnd.xmi file
must match the binding configuration for the response receiver in
the ibm-webservicesclient-bnd.xmi file.
The
following steps are for the client-side response receiver, which is
defined in the ibm-webservicesclient-bnd.xmi file
and the server-side request receiver, which is defined in the ibm-webservices-bnd.xmi file.
Procedure
- Configure an assembly tool to work with a Java™ Platform, Enterprise Edition (Java EE) enterprise application.
For
more information, see the related information on Assembly Tools.
- Create a web services-enabled Java EE
enterprise application.
- Click .
- Under Manage modules, click URI_name.
- Under Web Services Security Properties, click Web
services: client security bindings to edit the response
receiver binding information, if web services are acting as a client.
- Under Response receiver binding, click Edit.
- Under Additional properties, click Trust
anchors.
- Click New to create a new trust
anchor.
- Enter a unique name within the request receiver binding
for the Trust anchor name field.
The name is used to reference
the trust anchor that is defined.
- Enter the keystore password, path, and keystore type.
- Click the trust anchor name link to edit the selected
trust anchor.
- Click Remove to remove the selected
trust anchor or anchors.
When you start the application,
the configuration is validated in the run time while the binding information
is loading.
- Return to the web services-enabled module panel accessed
in step 2.
- Under Web Services Security Properties, click Web
services: server security bindings to edit the request
receiver binding information.
- Under Request receiver binding, click Edit.
- Under Additional properties, click Trust
anchors.
- Click New to create a new trust
anchor
Enter a unique name within the request receiver
binding for the Trust anchor name field. The name is used to reference
the trust anchor that is defined.
Enter the keystore password,
path, and keystore type.
Click the trust anchor name link to
edit the selected trust anchor.
Click Remove to
remove the selected trust anchor or anchors.
When you start
the application, the configuration is validated in the run time while
the binding information is loading.
- Save the changes.
Results
This procedure defines trust anchors that can be used by the
request receiver or the response receiver (if the web services is
acting as client) to verify the signer certificate.
Example
The request receiver or the response receiver (if the web
service is acting as a client) uses the defined trust anchor to verify
the signer certificate. The trust anchor is referenced using the trust
anchor name.