Question
SedgwickCMS
US
Last activity: 17 Sep 2015 16:00 EDT
Creating the Truststore and JKS Keystore or Create the keystore and generate a certificate
I am consuming the SOAP Service in Pega. The provider of the service didn't provide any authentication mechanism like.
1. JKS key Store
2. .Cert file
If want to generate a JKS Key Store and to generate the certificate. What tool or steps needs to be performed.
So that i can repeat these steps for each environment and put it as WS-Security Profile in SOAP etc.
Pega is new implementation along with new web services. JKS Key Store and to generate the certificate are new. Please help.
Accepted Solution
Pegasystems Inc.
GB
Generating Certficates / Keystores is done outside of PRPC - and follows the standard methods for creating key-pairs, exporting certificates and importing trusted certificates.
There are many tutorials on the web about doing this kind of thing using the 'keytool' commandline tool (for example: To Use keytool to Create a ServerCertificate (The Java EE 6 Tutorial)) : but I think using a GUI such as 'keystore explorer' is easier : http://keystore-explorer.sourceforge.net/
The overview of doing this (if you want to setup a server and a client) is essentially this:
0. Create a KEYSTORE on your server (or use an existing one).
1. Create a KEYPAIR on the server (say webserver, but could be emailserver or soap service etc).
You will keep one half the key secret (with a password that only you know).
You probably want to set the 'name' field of the certificate to be the same as the server's hostname. (this isn't strictly necessary - but some clients will use 'hostname verification' on the certificate, and reject certificates unless this is the case).
2. Export your CERTIFICATE from this KEYPAIR: this is the non-secret side of your KEYPAIR - it doesn't have a password and everybody gets access it.
Generating Certficates / Keystores is done outside of PRPC - and follows the standard methods for creating key-pairs, exporting certificates and importing trusted certificates.
There are many tutorials on the web about doing this kind of thing using the 'keytool' commandline tool (for example: To Use keytool to Create a ServerCertificate (The Java EE 6 Tutorial)) : but I think using a GUI such as 'keystore explorer' is easier : http://keystore-explorer.sourceforge.net/
The overview of doing this (if you want to setup a server and a client) is essentially this:
0. Create a KEYSTORE on your server (or use an existing one).
1. Create a KEYPAIR on the server (say webserver, but could be emailserver or soap service etc).
You will keep one half the key secret (with a password that only you know).
You probably want to set the 'name' field of the certificate to be the same as the server's hostname. (this isn't strictly necessary - but some clients will use 'hostname verification' on the certificate, and reject certificates unless this is the case).
2. Export your CERTIFICATE from this KEYPAIR: this is the non-secret side of your KEYPAIR - it doesn't have a password and everybody gets access it.
3. IMPORT the CERTIFICATE into your CLIENT's TRUSTSORE.
When you attach your CLIENT to the SERVER: one of the first things your SERVER will do - is to provide this CERTIFCATE to your CLIENT.
Your CLIENT (because it has a reference copy in it's TRUSTSTORE) will TRUST this SERVER and allow the Secure Connection to continue.
This method is usually only suitable for testing (you are using a SELF-SIGNED CERTIFICATE here): generally you have to pay a trusted organization (Verisign etc) to SIGN your CERTIFICATE; which saves you having to import the CERTIFICATE into your TRUSTSTORE (instead the trust will be based on the fact that your TRUSTSTORE contains a list of trusted authorities (including Verisign) and will accept a signed CERTIFICATE instead).
If you are trying to attach your PRPC system to an existing third-party system which is running over SSL: then you can ask them for the certificate (if it is self-signed) : or you can extract it yourself.
If it is running over HTTP: just attach your browser to the endpoint: and then download the CERTIFICATE: and install that it into your Java Trust Store. (you can import the file (PEM format) directly into the KeyStore Explorer (I think....)
Pegasystems Inc.
US
the link has a section on how to use keytool: Apache CXF -- WS-Security. Or if you prefer UI, you can use keyexplorer free tool.