test

Sun Java System Application Server Enterprise Edition 8.1 2005Q2 Administration Guide

Working with Certificates and SSL

About Certificate Files

Installation of the Application Server generates a digital certificate in NSS (Network Security Services) format suitable for internal testing. By default, the Application Server stores its certificate information in a certificate database in the domain-dir/config directory:

ProcedureTo change the location of certificate files

The keystore and truststore files provided for development are stored in the domain-dir/config directory.

  1. In the Admin Console tree, expand Configurations.

  2. Expand the server-config (Admin Config) node.

  3. Select the JVM Settings node.

  4. Click the JVM Options tab.

  5. On the JVM Options page, add or modify the following values in the Value field to reflect the new location of the certificate files:


    -Dcom.sun.appserv.nss.db=${com.sun.aas.instanceRoot}/NSS-database-directory

    where NSS-database-directory is the location of the NSS database.

  6. Click Save.

  7. Restart the Application Server if Restart Required displays in the console.

Using Java Secure Socket Extension (JSSE) Tools

Use keytool to set up and work with JSSE (Java Secure Socket Extension) digital certificates. In the Platform Edition, the Application Server uses the JSSE format on the server side to manage certificates and key stores. In both the Platform Edition and Enterprise Edition, the client side (appclient or stand-alone) uses the JSSE format.

The J2SE SDK ships with keytool, which enables the administrator to administer public/private key pairs and associated certificates. It also enables users to cache the public keys (in the form of certificates) of their communicating peers.

To run keytool, the shell environment must be configured so that the J2SE /bin directory is in the path, or the full path to the tool must be present on the command line. For more information on keytool, see the keytool documentation at http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/keytool.html.

Using the keytool Utility

The following examples demonstrate usage related to certificate handling using JSSE tools:

ProcedureTo generate a certificate using the keytool utility

Use keytool to generate, import, and export certificates. By default, keytool creates a keystore file in the directory where it is run.

  1. Change to the directory where the certificate is to be run.

    Always generate the certificate in the directory containing the keystore and truststore files, by default domain-dir/config. For information on changing the location of these files, see To change the location of certificate files.

  2. Enter the following keytool command to generate the certificate in the keystore file, keystore.jks:


    keytool -genkey -alias keyAlias-keyalg RSA
 -keypass changeit
 -storepass changeit
-keystore keystore.jks

    Use any unique name as your keyAlias. If you have changed the keystore or private key password from their default, then substitute the new password for changeit in the above command.

    A prompt appears that asks for your name, organization, and other information that keytool uses to generate the certificate.

  3. Enter the following keytool command to export the generated certificate to the file server.cer (or client.cer if you prefer):


    keytool -export -alias keyAlias-storepass changeit
 -file server.cer
 -keystore keystore.jks

  4. If a certificate signed by a certificate authority is required, see To sign a digital certificate using the keytool utility.

  5. To create the truststore file cacerts.jks and add the certificate to the truststore, enter the following keytool command:


    keytool -import -v -trustcacerts
-alias keyAlias
 -file server.cer
-keystore cacerts.jks
 -keypass changeit

    If you have changed the keystore or private key password from their default, then substitute the new password for changeit in the above command.

    The tool displays information about the certificate and prompts whether you want to trust the certificate.

  6. Type yes, then press Enter.

    Then keytool displays something like this:


    Certificate was added to keystore
[Saving cacerts.jks]

  7. Restart the Application Server.

ProcedureTo sign a digital certificate using the keytool utility

After creating a digital certificate, the owner must sign it to prevent forgery. E-commerce sites, or those for which authentication of identity is important can purchase a certificate from a well-known Certificate Authority (CA). If authentication is not a concern, for example if private secure communications is all that is required, save the time and expense involved in obtaining a CA certificate and use a self-signed certificate.

  1. Follow the instructions on the CA’s Web site for generating certificate key pairs.

  2. Download the generated certificate key pair.

    Save the certificate in the directory containing the keystore and truststore files, by default domain-dir/config directory. See To change the location of certificate files.

  3. In your shell, change to the directory containing the certificate.

  4. Use keytool to import the certificate into the local keystore and, if necessary, the local truststore.


    keytool -import -v -trustcacerts
-alias keyAlias
 -file server.cer
-keystore cacerts.jks
 -keypass changeit
-storepass changeit

    If the keystore or private key password is not the default password, then substitute the new password for changeit in the above command.

  5. Restart the Application Server.

Deleting a Certificate Using the keytool Utility

To delete an existing certificate, use the keytool -delete command, for example:

keytool -delete
 -alias keyAlias
 -keystore keystore-name
 -storepass password

For a complete list of possible options for the -delete command, refer to the keytool documentation at http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/keytool.html.

Using Network Security Services (NSS) Tools

In the Enterprise Edition, use Network Security Services (NSS) digital certificates on the server-side to manage the database that stores private keys and certificates. For the client side (appclient or stand-alone), use the JSSE format as discussed in Using Java Secure Socket Extension (JSSE) Tools.

The tools for managing security with Network Security Services (NSS) include the following:

The tools are located in the install-dir/lib/ directory. The following environment variables are used to point to the location of the NSS security tools:

In the examples, the certificate common name (CN) is the name of the client or server. The CN is also used during SSL handshake for comparing the certificate name and the host name from which it originates. If the certificate name and the host name do not match, warnings or exceptions are generated during SSL handshake. In some examples, the certificate common name CN=localhost is used for convenience so that all users can use that certificate instead of creating a new one with their real host name.

The examples in the following sections demonstrate usage related to certificate handling using NSS tools:

Using the certutil Utility

The certificate database tool, certutil, is an NSS command-line utility that can create and modify the Netscape Communicator cert8.db and key3.db database files. It can also list, generate, modify, or delete certificates within the cert8.db file and create or change the password, generate new public and private key pairs, display the contents of the key database, or delete key pairs within the key3.db file.

The key and certificate management process generally begins with creating keys in the key database, then generating and managing certificates in the certificate database. The following document discusses certificate and key database management with NSS, including the syntax for the certutil utility: http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html.

Each of the items in the list below gives an example using NSS and JSSE security tools to create and/or manage certificates.

Importing and Exporting Certificates Using the pk12util Utility

The command-line utility used to import and export keys and certificates between the certificate/key databases and files in PKCS12 format is pk12util. PKCS12 is Public-Key Cryptography Standards (PKCS) #12, Personal Information Exchange Syntax Standard. More description of the pk12util utility can be read at http://www.mozilla.org/projects/security/pki/nss/tools/pk12util.html.

Adding and Deleting PKCS11 Modules using modutil

The Security Module Database Tool, modutil, is a command-line utility for managing PKCS #11 (Cryptographic Token Interface Standard) module information within secmod.db files or within hardware tokens. You can use the tool to add and delete PKCS #11 modules, change passwords, set defaults, list module contents, enable or disable slots, enable or disable FIPS-140-1 compliance, and assign default providers for cryptographic operations. This tool can also create key3.db, cert7.db, and secmod.db security database files. For more information on this tool, see http://www.mozilla.org/projects/security/pki/nss/tools/modutil.html.