+

Search Tips   |   Advanced Search

Keystores

The Liberty profile can create only a keystore type of Java Keystore (JKS). Support for other types of keystore in the Liberty profile can depend on what is supported by the underlying Java Runtime Environment (JRE). The following are the different keystore types in the Liberty profile.


JKS and JCEKS

Java Keystore (JKS) and Java Cryptography Extensions Keystore (JCEKS) are common between the IBM JRE and the Oracle JRE, and can be configured the same using either JRE. JKS is the default keystore type in the Liberty profile, and the only type of keystore the Liberty profile can create. If no keystore type is specified in the configuration, JKS is used.

An example of JKS keystore configuration...

An example of JCEKS keystore configuration...


PKCS12 keystore

Public Key Cryptography Standards #12 (PKCS12) keystore can be used, but not created by the Liberty profile, when we use the IBM JRE. An example of PKCS12 keystore configuration...


CMS keystore

CMS keystore can be configured, but not created by the Liberty profile, when we use the IBM JRE. However, some special configuration is required. The CMS provider is not available by default on the IBM JRE, therefore it must be added to the provider list in the java.security file of the IBM JRE. In the following example, the com.ibm.security.cmskeystore.CMSProvider class is added to the end of the list. Ensure that the provider number is correct in the provider list. The Liberty profile does not use the CMS keystore stash file to gain access to the keystore.

To use the CMS keystore, the configuration in server.xml is as follows:


Parent topic: Enable SSL communication

Reference: