Configure trust anchors for the consumer binding on the application level

You can configure trust anchors for the consumer binding at the application level.

Overview

This article does not describe how to configure trust anchors at the server or cell level. Trust anchors that are defined at the application level have a higher precedence over trust anchors that are defined at the server or cell level. For more information on creating and configuring trust anchors on the server or cell level, see Configuring trust anchors on the server or cell level.

You can configure a trust anchor at the application level using an assembly tool or the administrative console. This article describes how to configure the application-level trust anchor using the administrative console.

A trust anchor specifies key stores that contain trusted root Certificate Authority (CA) certificates, which validate the signer certificate. These keystores are used by the request consumer (as defined in the ibm-webservices-bnd.xmi file) and the response consumer (as defined in the ibm-webservicesclient-bnd.xmi file when a Web service is acting as a client) to validate the X.509 certificate in the SOAP message. The keystores are critical to the integrity of the digital signature validation. If the keystores are tampered with, the result of the digital signature verification is doubtful and comprised. Therefore, it is recommended that you secure these keystores. The binding configuration specified for the request consumer in the ibm-webservices-bnd.xmi file must match the binding configuration for the response consumer in the ibm-webservicesclient-bnd.xmi file. The trust anchor configuration for the request consumer on the server side must match the request generator configuration on the client side. Also, the trust anchor configuration for the response consumer on the client side must match the response generator configuration on the server side.

Complete the following steps to configure trust anchors for the consumer binding on the application level:

Procedure

1. Locate the trust anchor panel in the administrative console.

   1. Click Applications > Enterprise applications > application_name.

   2. Under Manage modules, click URI_name.

   3. Under Web Services Security Properties you can access the trust anchor configuration for the following bindings:

      • For the request consumer (receiver) binding, click Web services: Server security bindings. Under Request consumer (receiver) binding, click Edit custom.

      • For the response consumer (receiver) binding, click Web services: Client security bindings. Under Response consumer (receiver) binding, click Edit custom.

   4. Under Additional properties, click Trust anchors.

   5. Click one of the following to work with trust anchor configuration:

      New

      To create a trust anchor configuration. Enter a unique name in the Trust anchor name field.

      Delete

      To delete the existing configuration selected in the box next to the configuration.

      an existing trust anchor configuration

      To edit the settings of an existing trust anchor configuration.

2. Specify the keystore password, the keystore location, and the keystore type. A trust anchor keystore file contains the trusted root Certificate Authority (CA) certificates that are used for validating the X.509 certificate that is used in digital signature or XML encryption.

   1. Specify a password in the Key store password field. This password is used to access the keystore file.

   2. Specify the location of the keystore file in the Key store path field.

   3. Select a keystore type from the Key store type field. The Java Cryptography Extension (JCE) that is used by IBM supports the following keystore types:

      JKS

      Use this option if you are not using Java Cryptography Extensions (JCE) and if your keystore file uses the Java Keystore (JKS) format.

      JCEKS

      Use this option if you are using Java Cryptography Extensions.

      PKCS11KS (PKCS11)

      Use this format if your keystore file uses the PKCS#11 file format. Keystore files that use this format might contain RSA keys on cryptographic hardware or might encrypt keys that use cryptographic hardware to ensure protection.

      PKCS12KS (PKCS12)

      Use this option if your keystore file uses the PKCS#12 file format.

      WebSphere Application Server provides some sample keystore files in the ${USER_INSTALL_ROOT}/etc/ws-security/samples directory. For example, you might use the enc-receiver.jceks keystore file for encryption keys. The password for this file is storepass and the type is JCEKS. Attention: Do not use these keystore files in a production environment. These samples are provided for testing purposes only.

Results

What to do next

Related tasks

Related Reference