Configuring SSL for WebSphere Application Server

Log in as the root user.

Create a user by entering the following command in a command prompt:

• (Linux and Sun Solaris) useradd

• (IBM AIX) mkuser

Set the password of the new user by entering passwd in the command prompt.

(Linux and Solaris) Create a shadow password file by entering pwconv (with no parameters) in the command prompt.

Open the group file from the /etc directory in a text editor.

Add the user who you created in step 2 to the root group.

Save and close the file.

(UNIX with SSL enabled) Start and stop WebSphere as the root user.

Log in to Windows by using an administrator user account.

Select Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups.

Right-click Users and select New User.

Type a user name and password in the appropriate boxes, and type any other information you require in the remaining boxes.

Deselect User Must Change Password At Next Login, click Create, and then click Close.

Click Users, right-click the user you just created and select Properties.

Click the Member Of tab and then click Add.

In the Enter The Object Names To Select box, type Administrators, click Check Names to ensure that the group name is correct.

Click OK and then click OK again.

Select Start > Control Panel > Administrative Tools > Local Security Policy > Local Policies.

Click User Rights Assignment, and then right-click Act as Part of the Operating System and select Properties.

Click Add User or Group.

In the Enter The Object Names To Select box, type the name of the user you created in step 4, click Check Names to ensure that the name is correct, and then click OK.

Click OK to close the Act As Part Of The Operating System Properties dialog box.

Ensure that WebSphere is running.

In WebSphere Administrative Console, select Security > Global Security.

Under Administrative security, select Administrative user roles.

Click Add and do the following:

Click OK and save your changes.

Restart the WebSphere profile.

In WebSphere Administrative Console, select Security > Global Security.

Click Security Configuration Wizard.

Ensure Enable Application Security checkbox is enabled. Click Next.

Select Federated Repositories and click Next.

Specify the credentials you want to set and click Next.

Click Finish.

Restart the WebSphere profile.

WebSphere will start using the default keystore and truststore.

In WebSphere Administrative Console, select Security > SSL certificate and key management.

Click Keystores and certificates under Related items.

In the Key store usages dropdown, ensure that SSL Keystores is selected. Click New.

Type a logical name and description.

Specify the path where you want your keystore to be created. If you have already created a keystore through ikeyman, specify the path to the keystore file.

Specify and confirm the password.

Choose the keystore type and click Apply.

Save the master configuration.

Click Personal Certificate.

If you had added already created a keystore using ikeyman, your certificate will appear. Otherwise, you need to add a new self-signed certificate by performing the following steps:

Repeat steps 2 through 10 for creating a truststore.

In WebSphere Administrative Console, select Security > SSL certificate and key management.

Click Manage endpoint security configuration. The local topology map opens.

Under Inbound, select direct child of nodes.

Under Related items, select SSL configurations.

Select NodeDeafultSSLSetting.

From the truststore name and keystore name drop-down lists, select the custom truststore and keystore that you created.

Click Apply.

Save the master configuration.

Restart the WebSphere profile.

Your profile now runs on custom SSL settings and your certificate.

In WebSphere Administrative Console, select Security > Global Security.

In the Authentication section, expand RMI/IIOP security and click CSIv2 inbound communications.

Ensure that SSL-supported is selected in the Transport drop down list.

Restart the WebSphere profile.

Ensure that WebSphere is running.

In WebSphere Administrative Console, navigate to Signer certificates and then click Security > SSL Certificate and Key Management > Key Stores and Certificates > NodeDefaultTrustStore > Signer Certificates.

Click Retrieve From Port and perform these tasks:

• In the Host box, type the URL. For example, type www.paypal.com.

• In the Port box, type 443. This port is the default SSL port.

• In the Alias box, type an alias.

Click Retrieve Signer Information and then verify that the information is retrieved.

Click Apply and then click Save.

In WebSphere Administrative Console, select Servers > Server Types > WebSphere application server.

In the Preferences section, select your server.

In the Configuration tab, under Communications section, expand Ports, and click Details.

Click the following port names, change the port number to 0, and click OK.

• ORB_LISTENER_ADDRESS

• SAS_SSL_SERVERAUTH_LISTENER_ADDRESS

• CSIV2_SSL_SERVERAUTH_LISTENER_ADDRESS

• CSIV2_SSL_MUTUALAUTH_LISTENER_ADDRESS

Open [aem-forms_root]\crx-repository\launchpad\sling.properties file for editing.

Locate the sling.bootdelegation.ibm property and add com.ibm.websphere.ssl.* to its value field. The updated field look like the following:

Save the file and restart the server.