Obtaining and Installing a Signed Certificate

The following procedures explain how to obtain and install a signed certificate.

To Obtain a Signed Certificate

1. Use the J2SE keytool command to generate a certificate signing request (CSR) for the self-signed certificate you generated in the preceding section.

   Information about the keytool command can be found at

   http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/keytool.html

   
   

   Here is an example:

      keytool  -certreq  -keyalg RSA  -alias imq  -file certreq.csr
               -keystore /etc/imq/keystore  -storepass myStorePassword
   

   This generates a CSR encapsulating the certificate in the specified file (certreq.csr in the example).

2. Use the CSR to generate or request a signed certificate.

   You can do this by either of the following methods:

   • Have the certificate signed by a well known certification authority (CA), such as Thawte or Verisign. See your CA’s documentation for more information on how to do this.

   • Sign the certificate yourself, using an SSL signing software package.

     The resulting signed certificate is a sequence of ASCII characters. If you receive the signed certificate from a CA, it may arrive as an e-mail attachment or in the text of a message.

3. Save the signed certificate in a file.

   The instructions below use the example name broker.cer to represent the broker certificate.

To Install a Signed Certificate

1. Check whether J2SE supports your certification authority by default.

   The following command lists the root CAs in the system key store:

      keytool  -v  -list  -keystore $JAVA_HOME/lib/security/cacerts
   

   If your CA is listed, skip the next step.

2. If your certification authority is not supported in J2SE, import the CA’s root certificate into the Message Queue key store.

   Here is an example:

      keytool  -import  -alias ca  -file ca.cer  -noprompt  -trustcacerts
               -keystore /etc/imq/keystore  -storepass myStorePassword
   

   where ca.cer is the file containing the root certificate obtained from the CA.

   If you are using a CA test certificate, you probably need to import the test CA root certificate. Your CA should have instructions on how to obtain a copy.

3. Import the signed certificate into the key store to replace the original self-signed certificate.

   Here is an example:

      keytool  -import  -alias imq  -file broker.cer  -noprompt  -trustcacerts
               -keystore /etc/imq/keystore  -storepass myStorePassword
   

   where broker.cer is the file containing the signed certificate that you received from the CA.

   The Message Queue key store now contains a signed certificate to use for SSL connections.