Importing Keys and Certificates Into the Keystore

Each WebLogic domain maintains its own keystore in PIA_HOME\webserv\domain_name\keystore\pskey, and all servers within a domain can share the same keystore.

These utilities are available for importing keys and certificates into the keystore:

Utility	When to Use
pskeymanager	If you created the private key using the pskeymanager utility on a WebLogic platform, it's already installed in the keystore. You need only use pskeymanager to import your server certificate, which should contain your web server's signed public key, your trusted CA's root certificate, and any public keys necessary to establish a chain of trust between them.
ImportPrivateKey	If the private key was previously configured as an external file on an earlier WebLogic platform, you must import it into the WebLogic keystore along with the server certificate, using the ImportPrivateKey utility. The private key should be password-protected.

Using pskeymanager to Import the Server Certificate

To import the server certificate into the WebLogic keystore:

1. At a command prompt, change to the following directory:

   PIA_HOME\webserv\domain_name\piabin

   Where domain_name is the name of the installed PeopleSoft Pure Internet Architecture domain.

2. Enter the following command:

   pskeymanager -import

   Note:

   PeopleTools provides pskeymanager (a script wrapper to Java's keytool) to help manage the WebLogic keystore. For usage information, enter pskeymanager -help.

3. Follow the prompts and enter the requested information to create a new private key and a CSR for your web server.

   Keep the following in mind:

   • pskeymanager uses the keystore in PIA_HOME\webserv\domain_name\piaconfig\keystore\pskey.

   • pskeymanager prompts you for an alias for the server certificate, for example, ServerABC. This should be the same alias that you specified for the corresponding private key when you created it.

   • pskeymanager prompts you for the name of the server certificate file, for example, ServerABC-cert.pem. Include the file path if necessary.

Using ImportPrivateKey to Import an External Private Key File with the Server Certificate

To import a password-protected private key and the server certificate into the WebLogic keystore:

1. At a command prompt, change to the following directory:

   PIA_HOME\webserv\domain_name\bin

   Where domain_name is the name of an installed PeopleSoft Pure Internet Architecture domain.

2. Enter the following command:

   setEnv.cmd

   This sets the appropriate environment for Java commands.

3. Enter the following command:

   java utils.ImportPrivateKey keystore\pskey store_passprivatekey_aliasprivatekey_passservercert_fileprivatekey_file

   The parameters for this command are as follows:

   Field or Control	Description
   store_pass	Specify the password for the WebLogic pskey keystore.
   privatekey_alias	Specify an alias for the private key. This is the name by which the key will be accessible inside the keystore.
   privatekey_pass	Specify the password for the private key.
   servercert_file	Specify the path and name of the server certificate file that includes the issuing CA's root certificate.
   privatekey_file	Specify the path and name of the private key file.