Sun Java System Calendar Server 6 2005Q4 Administration Guide

Configuring SSL for Calendar Server

ProcedureTo Create a Certificate Database

An SSL implementation for Calendar Server requires a certificate database. The certificate database must define a Certificate Authority (CA) and certificates for Calendar Server. This section contains conceptual and task information:

Before You Begin

Before you create the certificate database, familiarize yourself with the following:

  1. Log in as or become superuser (root).

  2. Specify the certificate database password for certutil in /etc/opt/SUNWics5/config/sslPasswordFile. For example:

    # echo "password" 

    where password is your specific password.

  3. Create the certificate database alias directory. For example:

    # cd /var/opt/SUNWics5
     # mkdir alias
  4. Move to the bin directory and generate the certificate database (cert8.db) and key database (key3.db). For example:

    # cd /opt/SUNWics5/cal/bin
     # ./certutil -N -d /var/opt/SUNWics5/alias
                     -f /etc/opt/SUNWics5/config/sslPasswordFile

    Note –

    For this and other times when you must run the certutil utility, follow the examples exactly, or consult the certutil help page to understand the syntax.

    For example, in this case, do not run the utility with the -N option without also specifying the -d /file information.

  5. Generate a default self-signed root Certificate Authority certificate. For example:

    # ./certutil -S -n SampleRootCA -x -t "CTu,CTu,CTu"
     -s "CN=My Sample Root CA," -m 25000
     -o /var/opt/SUNWics5/alias/SampleRootCA.crt
     -d /var/opt/SUNWics5/alias
     -f /etc/opt/SUNWics5/config/sslPasswordFile -z
  6. Generate a certificate for the host. For example:

    # ./certutil -S -n SampleSSLServerCert -c SampleRootCA 
     -t "u,u,u"
     -s "," -m 25001
     -o /var/opt/SUNWics5/alias/SampleSSLServer.crt
     -d /var/opt/SUNWics5/alias 
     -f /etc/opt/SUNWics5/config/sslPasswordFile
     -z /etc/passwd

    where is the server host name.

  7. Validate the certificates. For example:

    # ./certutil -V -u V -n SampleRootCA  
        -d /var/opt/SUNWics5/alias
     # ./certutil -V -u V -n SampleSSLServerCert 
       -d /var/opt/SUNWics5/alias
  8. List the certificates. For example:

    # ./certutil -L -d /var/opt/SUNWics5/alias
     # ./certutil -L -n SampleSSLServerCert 
       -d /var/opt/SUNWics5/alias
  9. Use modutil to list the available security modules (secmod.db). For example:

    # ./modutil -list -dbdir /var/opt/SUNWics5/alias
  10. Change the owner of the alias file to icsuser and icsgroup (or the user and group identity under which Calendar Server will run). For example:

    # find /var/opt/SUNWics5/alias -exec chown icsuser {};
     # find /var/opt/SUNWics5/alias -exec chgrp icsgroup {};

ProcedureTo Request and Import a Certificate from a Root Certificate Authority

The following steps tell you how to generate a certificate request, submit it to the Public Key Infrastructure (PKI) Web site, and then import the certificate.

  1. Log in as or become superuser (root).

  2. Move to the bin directory:

    # cd /opt/SUNWics5/cal/bin
  3. Use certutil to generate a Certificate Request based on the Certificate Authority or Public Key Infrastructure (PKI) Web site. For example:

    # ./certutil -R -s ", 
    OU=hostname/ SSL Web Server, O=Sesta, 
    C=US" -p "408-555-1234" -o hostnameCert.req 
    -g 1024  -d /var/opt/SUNWics5/alias 
    -f /etc/opt/SUNWics5/config/sslPasswordFile  -z /etc/passwd -a

    where “” is the host name.

  4. Request an test certificate for an SSL web server from the Certificate Authority or Public Key Infrastructure (PKI) Web site. Copy and paste the contents from the hostnameCert.req file into the Certificate Request.

    You will be notified by when your certificate is signed and can be picked up.

  5. Copy the Certificate Authority Certificate Chain and SSL server certificate into text files.

  6. Import the Certificate Authority Certificate Chain into the certificate database to establish a Chain of Authority. For example:

    # ./certutil -A -n "GTE CyberTrust Root"
        -t "TCu,TCu,TCuw" 
        -d /var/opt/SUNWics5/alias 
        -i /export/wspace/Certificates/CA_Certificate_1.txt
        -f /etc/opt/SUNWics5/config/sslPasswordFile
    # ./certutil -A -n "Sesta TEST Root CA" 
        -t "TCu,TCu,TCuw" 
        -d /var/opt/SUNWics5/alias 
        -i /export/wspace/Certificates/CA_Certificate_2.txt
        -f /etc/opt/SUNWics5/config/sslPasswordFile
  7. Import the signed SSL server certificate:

    # ./certutil -A -n "hostname SSL Server Test Cert"
        -t "u,u,u" -d /var/opt/SUNWics5/alias 
        -i /export/wspace/Certificates/SSL_Server_Certificate.txt
        -f /etc/opt/SUNWics5/config/sslPasswordFile
  8. List the certificates in the certificate database:

    # ./certutil -L -d /var/opt/SUNWics5/alias
  9. Configure the SSL Server Nickname in the ics.conf file to be the signed SSL server certificate, For example: “hostname SSL Server Test Cert”.

    Note The host name for the service.http.calendarhostname and service.http.ssl.sourceurl parameters in the ics.conf file should match the host name on the SSL certificate (in case your system has several aliases). For example:

ProcedureTo Configure SSL Parameters in the ics.conf File

To implement SSL with Calendar Server, you must set specific parameters in the ics.conf file. If any of the parameters listed in the following table are not in the ics.conf file, add them to the file with the value specified. Since the ics.conf is read only at system startup (when start-cal is issued), the new values will not take effect until the Calendar Server is restarted. For a description of these SSL parameters, see SSL Configuration.

  1. Log in as an administrator with permission to change the configuration.

  2. Change to the /etc/opt/SUNWics5/cal/config directory.

  3. Save your old ics.conf file by copying and renaming it.

  4. Edit one or more of the parameters as shown in the following table:


















    " "(Supply an appropriate password)






    "443" (Default SSL port)

    Note –

    Not on port "80", which is the HTTP default port.


    "yes" (Entire session encrypted)


    “https”//localhost:port” (Supply the name of your local host, and the service.http.ssl.port value.)















  5. Save the file as ics.conf.

  6. Restart Calendar Server for the changes to take effect.