Obtaining Encryption Keys

If you already have a set of existing encryption keys configured as external files, you don't need to obtain new ones. To find the existing keys, refer to the documentation for the PeopleTools and WebLogic releases for which those keys were installed.

The following procedure outlines how to obtain new encryption keys.

To obtain new encryption keys:

  1. At a command prompt, change to the following directory:

    PIA_HOME\webserv\domain_name\piabin

    Where domain_name is the name of the installed PeopleSoft Pure Internet Architecture domain for which you want to obtain encryption keys.

  2. Enter the following command:

    pskeymanager -create

    Note:

    Pskeymanager is a script wrapper to Java's keytool, provided by PeopleSoft to manage the WebLogic keystore. For usage information, enter pskeymanager -help.

  3. Follow the prompts and enter the requested information to create a new private key and a CSR for your web server.

    • Pskeymanager uses the keystore in PIA_HOME\webserv\domain_name\piaconfig\keystore\pskey.

    • Pskeymanager prompts you for an alias for the new keys, for example, ServerABC. This is the name you'll use to refer to the keys in the future.

    • Pskeymanager prompts you for a Subject Alternate Name (SAN). Enter one or more domain name server (DNS), IP address, EMAIL, URI, or an arbitrary object identifier (OID) in the format type:value.

    • Pskeymanager prompts you for distinguished name fields. Enter the appropriate values for your organization.

    • Pskeymanager prompts you for information about the CSR expiration date, key size, key algorithms, and the private key password. All of these fields have default values.

    • Pskeymanager makes a backup copy of an existing pskey file.

    Pskeymanager creates the private key inside the keystore, and creates the CSR as a file called ServerABC_certreq.txt in the current directory. You use the CSR to obtain your signed public key certificate and a root certificate from a CA.

  4. Decide which trusted CA you want to sign your web server's public key, and follow their instructions to obtain the certificate.

    You can use any CA that's compatible with PKCS12 or Sun's Java JKS standard.

  5. Follow the instructions in the product documentation to install the certificate.

    See Security Administration: Installing Web Server-Based Digital Certificates.

Note:

Make backup copies of the server certificate and the root certificate before proceeding.