Preparing Keys and Certificates for the Keystore

Your encryption keys must be in privacy enhanced mail (PEM) format, which is Base64-encoded data. Base64 encoding uses only ASCII characters. A PEM-formatted key or certificate file has an extension of either .pem or .cer. If the file is in the binary distinguished encoding rules (DER) format, it has a .der extension. Use the der2pem Java utility to convert DER-formatted keys and certificates to PEM format.

For SSL to work, your WebLogic server must present its own public key to each client browser, along with the self-signed public key of a root CA that's also in the browser's keystore, as well as any keys necessary to establish a chain of trust between the two. All of these keys must be part of the same certificate file before you can import them into the WebLogic keystore.

If you generated the private key using pskeymanager on a WebLogic platform, it is automatically correctly formatted, password protected, and installed in the keystore with no additional steps required. However, if the private key was configured as an external file on an earlier WebLogic platform/version, you must properly format it and incorporate a password, before importing it into the current WebLogic keystore along with the public key certificates.

Converting DER Files to PEM Format

It's important to convert all DER-formatted key and certificate files to PEM format before you work with them further.

To convert DER-formatted key and certificate files to PEM format:

At a command prompt, change to the following directory:

PIA_HOME\webserv\domain_name

Where domain_name is the name of an installed PeopleSoft Pure Internet Architecture domain.
Enter the following command:
```
setenv.cmd
```
This sets the appropriate environment for Java commands.
For each DER-formatted key or certificate file, enter the following command:
```
java utils.der2pem filename.der
```
Make sure that you include the DER file's directory path. A new PEM file by the same name is created in the same location.

If you converted a private key file to PEM format, you must modify the header and footer to be compatible with WebLogic.

To modify the private key file header and footer:

Open the PEM-formatted private key file in a text editor.

Change the following line:

-----BEGIN CERTIFICATE-----

To this:

-----BEGIN RSA PRIVATE KEY-----

Change the following line:

-----END CERTIFICATE-----

To this:

 -----END RSA PRIVATE KEY-----

Save and close the private key file.

Establishing the Server Certificate Chain of Trust

Your server certificate must contain, in addition to the web server's public key, any keys necessary to establish a chain of trust that culminates in the self-signed root certificate of a trusted root CA. That CA's root certificate must be in the keystore of any browser that's used to access your web server. Most browsers have an extensive set of trusted root certificates in their keystores.

First append the root certificate of the CA who issued your server certificate to the server certificate file. If you determine that the root certificate is not likely to be in your users' browsers, you must also append to the certificate file a chain certificate that was issued to your CA by another CA, then a chain certificate issued to that CA, and so on, until you append a root certificate that was issued by a trusted CA to itself.

For example, if your server certificate file is demo_cert.pem and the CA's root certificate is ca_cert.pem, you can open demo_cert.pem in a text editor, then insert the contents of ca_cert.pem after adding a new line at the end of the file. Make sure that each certificate follows the previous one on the next line, as follows:

...
...
Dosdxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
DMICxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
...
...

The result is that demo_cert.pem, for example, now contains the data from both certificates.

Note:

You can also use the type command in Windows or the cat command in UNIX to combine the certificate files.

Password Protecting the Private Key

Private keys inside the WebLogic keystore are password protected. You can't import an external private key file into the keystore without a password. If it isn't currently password protected, use the WebLogic wlkeytool utility to incorporate a password into the private key file.

To password-protect an external PEM-formatted private key file:

At a command prompt, change to the following directory:

WL_HOME\server\native\win\32

Where WL_HOME is the root directory where you installed WebLogic.
Enter the following command:
```
wlkeytool insecure_privatekey.pem secure_privatekey.pem
```
Where insecure_privatekey.pem is the name of the original private key file, and secure_privatekey.pem is the name of the resulting password-protected private key file.

Note:

Make sure that you include directory paths for the private key files.

The following message appears:
```
Enter password to unprotect private key:
```

Press Enter.

The following message appears:

Private key not PKCS8 encoded, trying RSA key
Private key file opened successfully
Enter password to protect private key :

Enter the password that you want to use for this key.

The following message appears:
```
Verify password to protect private key :
```
Enter the password again to confirm it.

The utility creates the password protected private key file that you specified. You import this key into the WebLogic keystore.