The root CA certificate that you install on the Apache HTTP Server instance must be the same certificate that is installed on the OpenSSO Enterprise host server.
Sun provides the Certificate Database Tool, certutil, in the Apache HTTP Server agent distribution file, to manage the root CA certificate and the certificate database.
For information about using certutil, see http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html.
Obtain the root CA certificate file that is installed on the OpenSSO Enterprise host server.
On the Apache HTTP Server instance, locate the certutil utility.
After you unzip the Apache HTTP Server agent distribution file, certutil is available in the PolicyAgent-base/bin directory.
For example: /opt/web_agents/apache_agent/bin/certutil
Before you use certutil, set the LD_LIBRARY_PATH environment variable to the location of the certutil library files.
After you unzip the Apache HTTP Server agent distribution file, these library files are available in the PolicyAgent-base/lib directory.
For example: /opt/web_agents/apache_agent/lib
If necessary, create the certificate database using certutil. For example:
# cd /opt/web_agents/apache_agent/bin # mkdir /opt/apache-2.0.63/conf/certdb # ./certutil -N -d /opt/apache-2.0.63/conf/certdb
Install the OpenSSO Enterprise root CA certificate using certutil. For example:
# ./certutil -A -n cert-name -t "C,C,C" -d /opt/apache-2.0.63/conf/certdb -i cert-request-file
where:
cert-name is the name of the OpenSSO Enterprise root CA certificate.
cert-request-file is the binary root CA certificate request file.
To verify that the root CA certificate is installed correctly, use certutil with the -L option. For example:
# ./certutil -L -d /opt/apache-2.0.63/conf/certdb
You should see the name of the root CA certificate.
Restart the Apache HTTP Server instance.