IBM GSKit

We can create a self signed root certificate using the IBM GSKit. In this example we are using Windows. Normally I use Linux for my demos, but I had to do this for a client-contract in a Windows environment and so I decided to add some of the know-how to this blog entry as a part of my IBM HTTP Server how-to guides for Windows. If you are using AIX or Linux, I am sure you can use this guide as reference, however there are often a few nuances that might be different on the ‘nix platforms.

Note: Only use gsk7cmd, the command line interface, if you are unable to implement IKEYMAN, the graphical user interface.

Global Security Kit (GSKit) certificate management tools are installed in the <ihs_install_root>/bin/ directory. These tools should only be run from the installation directory. Examples for the following commands should include the full directory path, such as <ihs_install_root>/bin/gsk7cmd.

Creating a new key database using the command-line interface

A key database is a file that the server uses to store one or more key pairs and certificates.

Note: You can use one key database for all your key pairs and certificates, or create multiple databases. This is also known as key ring in web terms.

Overview

To create a new key database using the gsk7cmd command-line interface enter a command using the following syntax:

Command Line options explained:

Note: You can create a new key database using the GSKCapiCmd tool. GSKCapiCmd is a tool that manages keys, certificates, and certificate requests within a CMS key database. The tool has all of the functionality that the existing GSKit Java command line tool has, except GSKCapiCmd supports CMS and PKCS11 key databases. If you plan to manage key databases other than CMS or PKCS11, use the existing Java tool. You can use GSKCapiCmd to manage all aspects of a CMS key database. GSKCapiCmd does not require Java to be installed on the system. For example

<ihsinst>/bin/gsk7capicmd -keydb -create -db <name> [-pw <passwd>] [-type <cms>] [-expire <days>] [-stash] [-fips] [-strong]

Example: Steps to create a new key db file the command line

1. Run the following command to create a new key database via the command line

1. The result is a new key database created in the pass specified

1. Just to see what it contains we will quickly us the IBM ikeyman tool to inspect the mykey.kdb file.
2. Launch ikeyman.bat and a Java GUI will load.

D:\ihs7\bin\ikeyman.bet

1. Select Key Database file | Open to open the mykey.kdb file

1. We will need to ensure that the type is CMS at this stage

1. Type the password, It is currently ihsadmin as per our create command earlier

1. Currently the key database is empty ie we have no Personal Certificates, Signer certificates or Personal Certificate requests (CSR).

   As seen below…

Note: We can create a new self signed certificate using the ikeyman tool, but at this time we want to learn how to use the gskit command line tool.

1. Close the ikeyman tool GUI

Changing the password via the command line

To change the password for a key database using the gsk7cmd command-line interface. Enter the following command as one line:

Command Line options explained:

Creating a self-signed certificate form the command line

A self-signed certificate provides a certificate to enable SSL sessions between clients and the server. Until you have an official SSL Certificate Authority (CA) who can provide the service of an officially-signed certificate as the result of certificate request (CSR), you can create a self signed certificate.

During the creation of a self-signed certificate, a private and public key are created during this process. Creating a self-signed certificate generates a self-signed X509 certificate in the identified key database. A self-signed certificate has the same issuer name as its subject name.

Note: When WebSphere Application Server profiles are being created you can now import an officially signed certificate. If you do not, the WAS profile management tool PMT part of the WebSphere Customisation Toolbox will create a new self-signed certificate. This allows the system to use SSL transports even when a officially signed certificate does not yet exist. This is why you get the SSL browser error when you try to access the Administrative console for the first time.

Steps to create a new self signed certificate via the command line:

1. Run the following command:

   gsk7cmd.bat -cert -create -db D:\ihs7\bin\mykey.kdb -pw ihsadmin -size 2048 -dn “CN=localhost, OU=Web Security, O=WebSphereTools, C=GB” -label myselfsignedcert -default_cert yes -expire 1 -san_dnsname localhost -san_emailaddr steve.robinson@webspheretools.com -san_ipaddr 127.0.0.1 -ca true

   gsk7cmd -cert -create -db mykeydb.kdb –pw ihsadmin -size 1024 -dn <distinguished_name> -label label> -default_cert <yes | no> – expire <days> [Updated in September 2010] -san dnsname <DNS name value>[,<DNS name value>] -san emailaddr <email address value>[,<email address value>] -san ipaddr <IP address value>[,<IP address value>] [-ca <true | false>]

2. Open the ikeyman tool GUI again as explained previously so we can see the new private self-signed certificate
3. We can now see that when we set the certificates view to be Personal Certificates as shown below there is now a new self signed certificate with the label “myselfsignedcert”. Take not of this label as we will use it later in the SSL configuration for IHS.

4. Select the cert as labelled by “myselfsignedcert” and click View/Edit

   As seen below, we can now that the personal certificate has been created and as issued by itself.

   Issued to : CN=localhost, OU=Web Security, O=WebSphereTools, C=GB

   Issued by: CN=localhost, OU=Web Security, O=WebSphereTools, C=GB

5. Click View details if you wish to get a tree view of the certificate.