Prev
Next
Forums S3 Systems Administration

SSL for MSCM & LBI - Websphere

Sort:
You are not authorized to post a reply.
Author
Messages
Roger French
Veteran Member
Posts: 545
Veteran Member
2/23/2016 12:06 PM
    Looking for working advice for installing SSL certificates for MSCM and LBI websites.

    Example: I want https://r:port>/mscm 

    Windows, no IIS, no HTTP/IHS, just Websphere 8.5.5 with appserver and node. Snoop smoketests work fine (with cert errors of course). Yes, DSSO is installed and it's working fine without any cert errors back to LSF. 

    What are your steps to install a CA Cert and Intermediate Cert into the specific places into MSCM/LBI Websphere security? I.E. SSL certificate and key management>>Key stores and certificates. 

    End result is of course, having your https://r:port>/mscm and https://:port>/efs URL without any cert errors. Same thing for LBI/IBI 

    Thanks in advance.
    Leonard Courchaine
    Veteran Member
    Posts: 55
    Veteran Member
    2/23/2016 2:33 PM
      Hi!
      We're SSL with everything here. Here are some bullet points dealing with MSCM and LBI:
      (note: WAS - Go to Security\SSL certificate and key management\Key stores and certificates)
      MSCM
      - WAS NodeDefaultKeyStore\Personal certs - Server cert of MSCM server
      - WAS NodeDefaultKeyStore\Signer certs - Your CA root cert
      - Java cacerts - Signer cert
      LBI
      - WAS NodeDefaultKeyStore\Personal certs - Server cert of LBI server
      - WAS NodeDefaultKeyStore\Signer certs - Your CA root cert
      - IIS - Server and Signer cert
      - WAS CMSKeyStore\Personal certs - Server cert of LBI server
      - WAS CMSKeyStore\Signer certs - Your CA root cert
      - Java cacerts - Your CA root cert

      Then you'll need, possibly, to update your MSCM and LBI services in LSF (if you have LSF) using ssoconfig or however you do that.

      Hope that helps.
      Lenny
      TJ Mann
      Veteran Member
      Posts: 44
      Veteran Member
      2/24/2016 11:38 AM
        Lenny,
        Do you have step to create cert ? i can be reached offline also (tjmannonline@yahoo.com). reason I asked, system admin always handed me cert, and i just deploy it/them. i just to know how to create one.
        Leonard Courchaine
        Veteran Member
        Posts: 55
        Veteran Member
        2/24/2016 1:02 PM
          Hi TJ,
          Process is pretty straightforward. Here it is:
          1. Create a cert request using an available tool, depending on your platform. For example, if you're on Unix, you can use ikeyman to create the request. In Windows, IIS, you can use IIS Manager. There are other tools too.
          2. Send the cert request to your certificate authority. So, for us, it's our Wintel team. If it's an internal cert, they produce the cert from the internal certificate authority (CA) Windows app. If it's external then they request it from our external CA (Thyte). They'll return a cert to you.
          3. Now you can complete the cert request with the cert they sent.

          Let me know if this is unclear or it needs further explanation.
          Lenny
          Roger French
          Veteran Member
          Posts: 545
          Veteran Member
          2/24/2016 3:27 PM
            Lenny - your instructions are saying use the CMSKeyStore for Personal and Signer Certs. In WAS 8.5.5, the CMSKeyStore isn't an option and isn't listed. The only KeyStore usages are SSL, RSA, Key, Root Certificates, Deleted Certificates and Default signers . If I select "All", CMSKeyStore doesn't appear on the page. There are several others but there aren't any with CMS.
            Leonard Courchaine
            Veteran Member
            Posts: 55
            Veteran Member
            2/24/2016 4:05 PM
              That's what we have in our environment. Yours must not have it.
              You are not authorized to post a reply.