The root CA certificate that you install on the remote Web Server 7.0 instance must be the same certificate that is installed on the OpenSSO Enterprise server.
To install the OpenSSO Enterprise root CA certificate on Web Server 7.0, see the Web Server 7.0 Update 3 documentation: http://docs.sun.com/coll/1653.3