Understanding Integration Gateway-Based Digital Certificates

Use the procedures discussed in this section for generating and installing digital certificates for use with the following security protocols:

  • Integration gateway encryption.

  • Client authentication.

  • WS-Security.

Elements of Integration Gateway-Based Digital Certificates

To set up integration gateway-based digital certificates, use the PSKeyManager utility to install digital certificates in the integration gateway keystore.

The integration gateway requires the following elements:

  • The gateway's private key.

  • A certificate containing the gateway's public key, digitally signed by a trusted CA.

  • A root certificate from the CA that signed the gateway's public key.

Using the PSKeyManager utility, you generate a private-public key pair, which is automatically inserted in the gateway keystore.

You generate a PEM-formatted CSR that contains the gateway's public key. You submit the CSR to the selected CA. The CA creates, digitally signs, and returns your gateway's public key certificate to you. This certificate also contains a signed copy of the CA's root certificate. These certificates may be in standard DER-encoded binary format, or they can be converted to PEM format if necessary.

You then install both signed certificates in the gateway keystore. In addition, you register them and the private key with the web server so that it can recognize and use them.

Keystore Location for Integration Gateway-Based Digital Certificates

The keystore location for integration gateway-based certificates is:

<PIA_HOME>\webserv\peoplesoft\piaconfig\keystore

Integration gateway, client authentication, and WS-Security certificates are stored in this location.

In addition, SSL/TLS digital certificates are also stored in this location.

wss.properties File

The wss.properties file stores keystore location information and password information for WS-Security digital certificates.

When installing digital certificates for WS-Security, you must specify the location of the keystore in this file.

You can also store an encrypted copy of the keystore password in this file.

The location of the file is: 

<PIA_HOME>\webserv\<DOMAIN>\peoplesoft\applications\PSIGW.war\WEB-INF\classes