Creating a Trust Database

Before requesting a server certificate you must create a trust database. In Proxy Server, the Administration Server and each server instance can have its own trust database. The trust database should only be created on your local computer.

When you create the trust database, you specify a password to be used for a key-pair file. You also need this password to start a server using encrypted communications. For a list of guidelines to consider when choosing a password, see Choosing Strong Passwords.

In the trust database you create and store the public and private keys, referred to as your key-pair file. The key-pair file is used for SSL encryption. You use the key-pair file when you request and install your server certificate. The certificate is stored in the trust database after installation.

The key-pair file is stored encrypted in the following directory.

server-root/alias/proxy-serverid-key3.db

The Administration Server can have only one trust database. Each server instance can have its own trust database.

To Create a Trust Database

1. Access either the Administration Server or the Server Manager and click the Security tab.

2. Click the Create Database link.

3. Type a password for the trust database.

4. Type the password again and click OK.

Using password.conf

By default, the Proxy Server prompts the administrator for the key database password before starting up. To restart an unattended Proxy Server, you must save the password in a password.conf file. Do this only if your system is adequately protected, so that this file and the key databases are not compromised.

Typically, you cannot start a UNIX SSL-enabled server with the /etc/rc.local or the /etc/inittab files because the server requires a password before starting. Although you can start an SSL-enabled server automatically if you keep the password in plain text in a file, doing so is unsafe. The server’s password.conf file should be owned by root or the user who installed the server, with only the owner having read and write access to the file.

On UNIX, leaving the SSL-enabled server’s password in the password.conf file is a large security risk. Anyone who can access the file has access to the SSL-enabled server’s password. Consider the security risks before keeping the SSL-enabled server’s password in the password.conf file.

On Windows, if you have an NTFS file system, you should protect the directory that contains the password.conf file by restricting access, even if you do not use the file. The directory should have read and write permissions for the Administration Server user and the Proxy Server user. Protecting the directory prevents others from creating a false password.conf file. You cannot protect directories or files on FAT file systems by restricting access to them.

Starting an SSL-Enabled Server Automatically

To start an SSL-Enabled Server Automatically

1. Make sure SSL is enabled.

2. Create a new password.conf file in the config subdirectory of the Proxy Server instance.

   • If you are using the internal PKCS #11 software encryption module included with the Proxy Server, type the following information:internal:your-password

     • If you are using a different PKCS #11 module for hardware encryption or hardware accelerators, specify the name of the PKCS #11 module, followed by the password, for example:nFast:your-password

       You will always be prompted to supply a password when starting the Proxy Server, even after the password.conf file has been created.