Installing PSMCAPI Certificates

To install PSMCAPI certificates:

1. Generate a private key in the keystore using the following command:

   keytool -genkeypair -alias <fully qualified machine name> -keystore <full path to the psmcapi keystore>

   You will be prompted to enter various inputs. Ensure that the name field is fully qualified name of the machine where psmcapi is running. This command creates the keystore if it does not already exist.

   Example:

   >keytool -genkeypair -alias example.oracle.com -keystore psmcapi_keystore
   Enter keystore password:
   Re-enter new password:
   What is your first and last name?
     [Unknown]:  example.oracle.com
   What is the name of your organizational unit?
     [Unknown]:  PeopleTools
   What is the name of your organization?
     [Unknown]:  PeopleSoft
   What is the name of your City or Locality?
     [Unknown]:  Pleasanton
   What is the name of your State or Province?
     [Unknown]:  CA
   What is the two-letter country code for this unit?
     [Unknown]:  US
   Is CN=example.oracle.com, OU=PeopleTools, O=PeopleSoft, L=Pleasanton, ST=CA, C=US correct?
     [no]:  yes
   Enter key password for <example.oracle.com>
           (RETURN if same as keystore password):
   

2. Generate the certificate request using the following command:

   keytool -certreq -alias <same alias as in step 1> -file <output filename> -keystore <full path to the Java keystore used by the CTI adapter>

   You will be prompted for the keystore password.

   Example:

   >keytool -certreq -alias example.oracle.com -file example.csr -keystore psmcapi_keystore
   Enter keystore password:
   >cat example.csr
   -----BEGIN NEW CERTIFICATE REQUEST-----
   MIICsDCCAm4CAQAwezELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRMwEQYDVQQHEwpQbGVhc2Fu
   dG9uMRMwEQYDVQQKEwpQZW9wbGVTb2Z0MRQwEgYDVQQLEwtQZW9wbGVUb29sczEfMB0GA1UEAxMW
   ...
   yYcbMAsGByqGSM44BAMFAAMvADAsAhRAU7bb602ca7ifVVHk1hwAJkTSNgIUCJP2oI3Sf4eD/7Ri
   gbHVPF4jnY4=
   -----END NEW CERTIFICATE REQUEST-----
   

3. To obtain your certificate, submit the CSR to the CA that issued the selected root certificate.

4. If necessary, import the Root CA certificate into the keystore. It is necessary if this certificate is not already in the Java truststore.

   keytool -import -alias <Root CA alias> -file <Root CA cert> -keystore <full path to the Java keystore used by the CTI adapter>

   You will be prompted for the keystore password.  Respond with yes when asked if you wish to trust this certificate.

   Example:

   >keytool -import -file RootCA.cer -alias RootCA -keystore psmcapi_keystore
   Enter keystore password:
   Owner: CN=example.oracle.com, OU=PeopleTools, O=PeopleSoft, L=Pleasanton, ST=CA, C=US
   ...
   Trust this certificate? [no]:  yes
   Certificate was added to keystore
   

5. Import the signed certificates into the psmcapi keystore using the following command:

   keytool -import -alias <same alias as in step 1> -file <certificate file> -keystore <full path to the Java keystore used by the CTI adapter> -trustcacerts

   You will be prompted for the keystore password.

   Example:

   >keytool -import -file abc.cer -alias example.oracle.com -keystore psmcapi_keystore -trustcacerts
   Enter keystore password:
   Certificate reply was installed in keystore

These are the certificates needed in your psmcapi keystore.  The client certificate (in this example, example.oracle.com) and the root CA certificate. The root CA certificate can also be stored in a separate truststore.

>keytool -list -keystore psmcapi_keystore
Enter keystore password:
Keystore type: PKCS12
Keystore provider: SUN
Your keystore contains 2 entries
example.oracle.com, Oct 14, 2020, PrivateKeyEntry,
Certificate fingerprint (SHA-256): AC:24:48:06:64:C8:F4:45:B3:92:39:72:DB:64:70:C1:FE
rootca, Oct 23, 2020, trustedCertEntry,
Certificate fingerprint (SHA-256): AE:34:20:21:A2:3B:5A:79:77:AD:46:E8:E6:78:B0:3A:5E

See Security Administration: Implementing Client Authentication.