To Obtain an Encryption Certificate from a Trusted Certificate Authority (Deployment Example 2: Federation Using SAML v2)

Deployment Example 2: Federation Using SAML v2

Previous: To Obtain an XML Signing Certificate from a Trusted Certificate Authority
Next: 6.2 Configuring Federation Manager 1 to Recognize the New Keystores and Key Files

To Obtain an Encryption Certificate from a Trusted Certificate Authority

The Liberty Identity specification requires all XML files to be signed. You can obtain and use one certificate to use for both signing and encryption. Or as an alternative, you can obtain one certificate to use for signing, and obtain a second certificate to use for encryption. In this deployment, for illustration purposes, one certificate is used for signing, and a second certificate is used for encryption.

As a root user, log in to the Federation Manager 1 host.

User Name:

amadmin

Password:

11111111

Go to the following directory:

/etc/opt/SUNWam/config

Create a keystore with a private key.

# keytool -genkey -alias LoadBalancer-9-enc -keyalg RSA -keysize 1024 
-dname "cn=LoadBalancer-9.siroe.com,o=siroe.com" -validity 365 
-keystore fmkeystore
Enter keystore password: keypassword
Enter key password for <LoadBalancer-9-enc>
			  (RETURN if same as keystore password): keypassword

Note –

The key password you specify here must be identical to the key password you specify for the encryption certificate.

Verify that the keystore and private key were created properly.

You should be able to see fmkeystore in the following directory, and verify that the current date is within the certificate's valid date range.

# cd /etc/opt/SUNWam/config
# ls -lrt
-rw-r--r--		1 root		root		1261 Nov 2 11:03  fmkeystore
# keytool -list -keystore fmkeystore -alias LoadBalancer-9-enc -v
# Enter keystore password: password
Alias name: LoadBalancer-9-enc
Creation date: Nov 7, 2006
Entry type: keyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=loadbalancer-9.siroe.com
Issuer: CN=Certificate Manager, OU=Identity Services, 
O=Sun Microsystems Inc., L=Santa Clara, ST=California, C=US
Serial number: 68f
Valid from: Tue Nov 07 15:56:17 PST 2006 until: Tue Aug 03 16:56:17 PDT 2010
Certificate fingerprints:
         MD5:  69:9C:CF:F6:0D:7E:F4:A7:A8:C3:DC:CD:2F:EC:1A:F4
         SHA1: 29:2F:71:98:6B:AD:4C:27:F2:53:08:94:E0:4B:AF:62:96:1F:B0:F0
Certificate[2]:
Owner: CN=Certificate Manager, OU=Identity Services, 
O=Sun Microsystems Inc., L=Santa Clara, ST=California, C=US
Issuer: CN=Certificate Manager, OU=Identity Services, 
O=Sun Microsystems Inc., L=Santa Clara, ST=California, C=US
Serial number: 320
Valid from: Mon Aug 16 00:00:00 PDT 2004 until: Mon Aug 16 00:00:00 PDT 2032
Certificate fingerprints:
         MD5:  CD:07:DF:A6:CA:B9:AB:94:FF:CF:17:35:AB:C2:C2:51
         SHA1: 9A:B5:F7:54:DE:8A:BC:E9:F6:1D:F1:5B:71:46:72:9E:F0:4E:B8:7A

Submit a request for an encryption certificate.

Create the request.

# cd /etc/opt/SUNWam/config
# keytool -certreq -alias LoadBalancer-9-enc 
-file cert-enc.csr -keystore fmkeystore
Enter keystore password: password
Enter key password for <LoadBalancer-9-enc>: keypassword

Verify that the request text was successfully generated.

# vi cert-enc.csr
-----BEGIN NEW CERTIFICATE REQUEST-----
mllBdjCB4AlBADA3MR1wEAYDVQQKEwlzaXjvZs5jb20xlTAfBgNVBAMTGGxvYWRiYWkhbmNlci05
LnNpcm9IlmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgykCgYEAozsGuaqGlL1Z5j6n+aXYACUh
KFpb8f451GG5Eg6Vy862hlstl1b8KaAYARHk0lGjzwb26AiLXlWpDyOmf2hXR91po7oo/Vw/K9Qv
qv/+7FDtCBp9DkcnHXR4aKNGknZ58Rn/VbURGqipvXSe2J+5EB46Nnq8jlGMba/2eSjeRfsCAwEA
AaAAMA0GCSqGSlb3DQEBBAUAA4GBAJ3u+f5mC7AVXErSDucNHZn4Li42ULQBEZmTk3K73U9Ar4wx
ex2Ee6lAsPDyb3g4jUmduBSkrSbKyxZhPutVZQTlfHkiLbd6vHWl1K97DedLoWlt9nZAo3xZyBym
6UCH0HYVly/TAL8fhsielElg8lsidlejis(hfkeowhkdlgile27uak9pwnbmqkdigleIDUekdo30
-----END OF NEW CERTIFICATE REQUEST-----

Follow the instructions provided by your Certificate Authority (CA) for submitting the cert-enc.csr file and sending the text to the CA.

The CA will process your request, and send you a certificate. When you open the certificate file with an editor, the certificate text will look similar to this:

In this deployment example, the certificate text was saved in a text file named fm-enc.

Import the certificate into the Load Balancer 9 keystore.

# keytool -import -alias LoadBalancer-9-enc -keystore fmkeystore 
-file fm-enc
Enter keystore password: password
Enter key password for <LoadBalancer-9-enc>: keypassword

Top-level certificate in reply:

Owner: CN=Certificate Manager, OU=Identity Services, 
O=Sun Microsystems Inc., L=Santa Clara, ST=California, C=US
Issuer: CN=Certificate Manager, OU=Identity Services, 
O=Sun Microsystems, Inc., L=Santa Clara, ST=California, C=US
Serial number:320
Valid from Mon Aug 16 00:00:00 PDT 2004 until: Mon Aug 16 00:00:00 PDT 2032
Certificate fingerprints:
			MDS:	CD:07:DF:A6:CA:B9:AB:94:FF:CF:17:35:AB:C2:C2:51
			SHA1:9A:B5:F7:54:DE:8A:BC:E9:F6:1D:F1:5B:71:46:72:9E:F0:4E:B8:7A

...is not trusted.  Install reply anyway? [no]:yes

Verify that the certificate is properly installed.

When you run this command, note that the Entry Type must be keyEntry as in this example. The keyEntry type contains both private key and the public certificate chain. You will need both of these. The trustedcertEntry type contains only the public key and no private key.

# keytool -list -keystore fmkeystore -alias LoadBalancer-9-enc -rfc
Enter keystore password: password
Alias name: LoadBalancer-9-enc
Creation date: Nov 2, 2006
Entry type: keyEntry
Certificate chain length: 2

Certificate text similar to the following is displayed:

Certificate [1] is the public key. This is the certificate that is presented to remote parties in a federated environment. Certificate [2] represents the certificate that authenticates the trusted authority or certificate issuer.