Configuring SSL for IBM HTTP Server (IHS) and IBM Websphere Application Server

Many times when working with Java 2 enterprise edition applications, you need to enable the SSL to secure the communication between endpoints of your app. This post aims to provide an instruction on how to create a SSL certificate using ikeyman tool and install it on an IHS, WAS pair which are running on Linux alike environment

A typical simple web architecture using IBM products would have an IHS running upfront as a web server to handle all requests from client(s) and then navigate them to a WebSphere Application Server (WAS). This chart may quickly describe the architecture:

 

So the connections need to be encrypted are as following:

1.     Connection between the web browser and the IHS

2.     The connect between the IHS and the WAS

We will take those 2 items separately in 2 parts. But first, lets go through the steps to generate SSL certificate using iKeyman tool

Creating new SSL certificate using iKeyman tool

iKeyman is a GUI based tool that helps you to manage digital certificates. It can be used to create key database, test a digital certificate, add certificate authority roots to the database, copy certificate between databases, request and receive certificates from a certificate authority, and so forth.

iKeyman can be found in IBM Http Server, WAS or IBM Jre installation packages.

There are two types of certificate you can use: self-signed and signed by a certificate authority. Let’s take the second one in our example.  

First step for this is creating a key database:

-       Start iKeyman tool: $sh /IHS root dir/bin/ikeyman.sh

-       Click on the Key Database File menu, and select New … , or click on the “New…” icon on the toolbar

-       Select CMS as Key database type and name the file, locate the location of the database file respectively

  

-       Set the password for the database and stash the password to the file if necessary.

-       From the Create menu, select New certificate request … menu item, or            click on the Create a new certificate request button on the tool bar

-       Carefully fill in the necessary information for the CR, example:

-       Save the certificate request to a place that can be used later to submit to CA for issuing the certificates

 -       After receiving the signed certificate files from the certificate authority, open the key database using the iKeyman tool and in the Key database content, select Personal Certificates and click Receive … button

-       Browse the cert file you just downloaded in the step above, click OK and you have the certificate ready to use.

-       Now copy the .kdb and .sth files over to your IHS server location and be ready for the next steps.

 

Configuring IHS for the SSL cert

-       Open the httpd.conf file of your IHS and modify it to use the .kdb and sth files created in the steps above

Here is an example:

LoadModule  ibm_ssl_module   modules/mod_ibm_ssl.so

<IfModule mod_ibm_ssl.c>

  Listen 443

  <VirtualHost  duyshat.com.vn:443>

    SSLEnable

    SSLTrace

    SSLClientAuth None

    SSLProxyEngine on

    SSLServerCert duyshat.com.vn

    Keyfile      "/path/to/keydatabasefile/duyshat.com.vn.kdb"

    SSLStashFile "/path/to/passwordfile/duyshat.com.vn.sth"

    ErrorLog logs/https-error_log

 </VirtualHost>

</IfModule>

-       Restart the IHS server

-       You’re done.