Use Authorized Signed SSL Certificate to IBM HTTP Server

To enable HTTPS access to front-end Web Server nodes running IBM HTTP Server 6.0, SSL certificates should be created, IHS configured to use SSL certificates and WAS configured for HTTPS traffic

These steps are useful if you want to use the self-signed SSL Certificate on IBM HTTP Server

1. Go to the Web Server machine to setup SSL for. Start the Key Management Utility from Windows Start button->IBM HTTP Server 6.0->Start Key Management Utility
2. From the menu bar of the Key Management Utility, go Key Database File->New to create a new key database
3. Choose “Key database type” of “CMS”. Define a file name and location for the new key database
4. 
5. When prompted, define a password for the key database. Check “Set expiration time?” and set “999” for “Days”. Check “Stash the password to a file?”. A password stash file will be created at the same location with the same name as the key database but having the extension “.sth”.
6. Once the key database had been created, from the menu bar of the Key Management Utility, go Create->New Certificate Request to create a new certificate request. Choose a “Key Size” of “1024”. Use the FQDN to access the IHS on this Web Server node for “Key Label” and “Common Name”. Fill in other details as appropriate
7. 
8. Define and take note of a file to store the certificate request file
9. 
10. Ensure the personal certificate request was properly created. Send the certificate request file to a certificate authority to generate a certificate suitable for use with web servers
11. Signer certificates of certificate authorities may need to be added to the key database before personal certificate signed by these certificate authorities can be added.
12. 
13. The signer certificates for the entire certification chain of the certification authority that will issue your personal certificate should be obtained.
14. In the Key Management Utility with the key database opened, choose “Signer Certificates” from the drop-down list in the Key database content area. Click on the “Add” button
15. 
16. Specified the signer certificate file and press “Ok”.
17. Define a label for the signer certificate.
18. Repeat the process for each certificate authority in the certification chain
19. Once the signer certificates had been added and the web server personal certificate issued by the certificate authority, the web server personal certificate is ready to be received into the key database
20. In the Key Management Utility with the key database opened, choose “Personal Certificates” from the drop-down list in the Key database content area. Click on the “Receive” button.
21. Specified the issue personal certificate file and press “Ok”.
22. Ensure the issued personal certificate was successfully received into the key database. The signer certificates addition and personal certificate request/receive processes should be done on each front-end Web Server machine intended for HTTPS.
23. 
24. Once the SSL certificate had been created for a Web Server, IBM HTTP Server 6.0 should be configured to use HTTPS.
25. On the Web Server machine, use a text editor to open the IHS configuration file at “<IHS_root>\conf\httpd.conf
26. Add the lines as shown below:
27. 
28. Restart the HTTP Server

---

Possibly related posts: (automatically generated)

• Extended Key Usage Issue – Applet JAR Signer
• SSL
• Asymmetric Keys: specify DoD PKI
• Howto setup SSL on Sun Java System Web Server 6.1 on Solaris