Question & Answer
Question
The export of an IIS certificate produces a .pfx formatted file. Getting the content of this file into an IBM® HTTP Server keystore requires specific steps to extract parts of the .pfx file. These parts then can be incorporated into a key store.
Answer
This process involves multiple steps and assumes that you have extracted the .pfx file from IIS. If you have not created the .pfx file from IIS, or you are unsure how to create this file, consult with Microsoft Support for those instructions.
 | Open the .PFX file |
 | Personal extraction |
 | Signer extraction |
 | Signer preparation |
 | New key file |
 | Adding the signer |
 | Importing the personal |
| Open the .PFX file |
- Start the iKeyman tool.
- Select Open from the Key Database File menu.
- Select PKCS12 for the Key Database Type within the open dialog box.
- Locate the .pfx file that was generated from the IIS export process. You will be prompted for a password.
At this point, iKeyman will display both the Personal Certificate and the associated Signer.
| Personal extraction |
- From the Personal Certificate area, click the Export/Import button to bring up the Export/Import Key dialog box.
- Select the Export radio button.
- Choose PKCS12 from the Key File Type list box.
- Provide a name for the file leaving the ".p12" extension, and alter the path to the file, if necessary.
- Click OK. This will bring up a Password Prompt dialog box.
- Enter a password and confirm it. At this point you have extracted a copy of the Personal Certificate into a .p12 format.
| Signer extraction |
The results of this next section may not be needed. It all depends on whether the default Signer certificates provided within a new key database file are all that are necessary to bring in the personal certificate generated from the section above. Execute these steps in case the Signer is required.
- Select Signer from the object list box.
- Select the Signer certificate and click Extract. This will bring up the Extract Certificate to a File dialog box.
- You can leave the default file type.
- Provide a name for the file leaving the extension, and alter the path to the file, if necessary.
- Click OK to complete the extraction.
| Signer preparation |
When this Signer file was created, it still had the personal certificate attached to it. This next set of instructions is necessary to separate the 2 certificates.
- Search for and locate the file created in the "Signer extraction" section just above.
- Make a copy of it and rename the new file with a ".cer" extension.
- Double click the new file to bring up the Microsoft Windows® "Certificate" panel. Within this panel, you can view the content of the certificate and its certification path.
- Select the Certification Path tab at the top of the panel. This window provides a visual view of the authentication chain. Usually, the last one listed is the personal certificate and those above represent the Signing authority.
- Select the Signing authority listed above the personal certificate.
- Below the viewing window, click View Certificate. This will bring up a new Microsoft Windows "Certificate" panel.
- Looking at this new panel, select the Details tab at the top. This tab provides all of the details associated the certificate you are viewing.
- Below the viewing window, click Copy to File. This will bring up the Certificate Export Wizard.
- Follow the prompts through the wizard choosing the defaults on each panel. When prompted, provide a name for the new file. This new file will be created in a binary format with the extension of ".cer".
| New key file |
Using the iKeyman tool, create a new key database file providing the necessary name and password information when you are prompted for it. Do not forget to check the box to Stash the password into a file?.
| Adding the signer |
- With the new key file open within iKeyman, select the "Signer" from the object list box.
- Click Add to bring up the Add CA's Certificate to a file dialog box. This will launch an Open dialog panel.
- Change the Data Type to Binary DER data.
- Click the Browse and locate the signer certificate created within the "Signer preparation" section.
- Click OK to add the signer. This will bring up a new panel asking for a label.
- Enter a label for the new signer and click OK. After this, your new signer should have been added.
| Importing the personal |
- Select Personal Certificates from the object list box.
- Click Import button. This will bring up the Import Key panel.
- Change the Key File Type to PKCS12.
- Click Browse to locate the personal certificate created from the section labeled "Personal extraction".
- Enter the password to this file when prompted and click OK. This will bring up the Change Labels panel which gives you the opportunity to change the label displayed within Ikeyman. This is not mandatory, but gives you the chance to put a meaningful text against your certificate rather than keeping the cryptic-like label displayed. This is especially useful if you plan to use the SSLServerCert directive within IBM HTTP Server to specifically point authentication to one of many certificates available within a single key database file.
- Select the certificate listed and type in a new label. Click Apply to set the new label.
- Click OK to complete the Import process.
At this point, you should have a working key database file that can be used with IBM HTTP Server.
Related Information
[{"Product":{"code":"SSEQTJ","label":"IBM HTTP Server"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"SSL","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"8.5;8.0;7.0","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"IBM HTTP Server","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"6.1;6.0","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]
Was this topic helpful?
Document Information
Modified date:
15 June 2018
UID
swg21269079