[WAS_8.0_CONCEPTS]Default chained certificate configuration in SSL

When a WebSphere Application Server process starts for the first time, the Secure Sockets Layer (SSL) runtime initializes the default keystores and truststores that are specified in the SSL configuration.

The chained certificates created during profile creation have a 1 year life span by default. The default root certificate used to signer the default chained certificate has a life span of 15 years. The life span of the default and the root certificates can be customized during profile creation. An advantage in this type of chained certificate is that only the signer from the root certificate is needed to establish trust. When the chained certificate is regenerated with the same root certificate, clients using that root signer certificate for trust do not lose their trust.

Default keystore and truststore properties

WebSphere Application Server creates the key.p12 default keystore file and the trust.p12 default truststore file during profile creation. A default, chained certificate is also created in the key.p12 file. The root signer, or public key, of the chained certificate is extracted from the key.p12 file and added to the trust.p12 file. If the files do not exist during process startup, they are recreated during startup.

You can easily identify keystore and truststore defaults because of their suffixes: DefaultKeyStore and DefaultTrustStore. Also, in the SSL configuration, you must set the fileBased attribute to true so that the runtime uses the default keystores and truststores only.

On a base application server, default key and truststores are stored in the node directory of the configuration repository. For example, the default key.p12 and trust.p12 stores are created with the AppSrv01 profile name, the test317Cell01 name, and the exampleNode01 node name. The key and truststores are located in the following directory:

test317:/ #
test317:/ # cd /opt/IBM/WebSphere/AppServer/profiles/AppSrv01/config/cells/test317Cell01/nodes/exampleNode01
test317:/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/config/cells/test317Cell01/nodes/exampleNode01 # ls -l *p12
-rw-r--r-- 1 root root 1298 Jun  1 15:56 default-signers.p12
-rw-r--r-- 1 root root 1434 Jun  1 15:56 deleted.p12
-rw-r--r-- 1 root root 3746 Jun  1 15:58 key.p12
-rw-r--r-- 1 root root 2594 Jun  1 15:56 root-key.p12
-rw-r--r-- 1 root root 3690 Jun  1 15:56 rsatoken-key.p12
-rw-r--r-- 1 root root 2594 Jun  1 15:56 rsatoken-root-key.p12
-rw-r--r-- 1 root root 1298 Jun  1 15:56 rsatoken-trust.p12
-rw-r--r-- 1 root root 2458 Jun  1 15:58 trust.p12
					

Copy of truststore and keystore also located in profile_home/etc directory:

test317:/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/etc # ls -al
total 56
drwxr-xr-x  3 root root 4096 Jun  1 16:07 .
drwxr-xr-x 20 root root 4096 Jul  6 13:40 ..
-rwxr-xr-x  1 root root 2334 Jul 11  2012 DummyClientKeyFile.jks
-rwxr-xr-x  1 root root 7117 May 19 10:35 DummyClientTrustFile.jks
-rwxr-xr-x  1 root root 2337 Jul 11  2012 DummyServerKeyFile.jks
-rwxr-xr-x  1 root root 6062 Jul 11  2012 DummyServerTrustFile.jks
-rw-r--r--  1 root root  238 Aug 10 15:29 IBMLSDActiveServerList.asl
-rwxr-xr-x  1 root root  727 Jul 11  2012 clientCert.arm
-rwxr-xr-x  1 root root 3690 May 19 10:35 key.p12
-rwxr-xr-x  1 root root  727 Jul 11  2012 serverCert.arm
-rwxr-xr-x  1 root root 2458 Jun  1 15:55 trust.p12
drwxr-xr-x  3 root root 4096 Sep 19  2012 ws-security
					

The default password is WebAS for all default keystores generated by WebSphere Application Server. Change the default password after the initial configuration for a more secure environment.

Default chained certificate

The default chained certificate of the server along with a root self-signed certificate used to sign the default chained certificate are created during profile creation.

You can recreate the certificates with different information simply by deleting the *.p12 files in /config and /etc. Change the eight properties below to the values you want the certificates to contain, then restart the processes. This causes the server certificate in /config and the client certificate in /etc to differ.

The certificate properties in the code example exist in the ssl.client.props file, but do not exist in the server configuration. You can use these certificate properties in the server configuration if you add them as custom security properties using the administrative console.

test317:/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/properties # ls -l ssl.client.props
-rwxr-xr-x 1 root root 5050 May 19 10:35 ssl.client.props
					

test317:/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/properties # cat ssl.client.props
#-------------------------------------------------------------------------
# Global SSL Properties (applies to entire process)
#-------------------------------------------------------------------------
com.ibm.ssl.defaultAlias=DefaultSSLSettings
com.ibm.ssl.performURLHostNameVerification=false
com.ibm.ssl.validationEnabled=false
com.ibm.security.useFIPS=false
user.root=/opt/IBM/WebSphere/AppServer/profiles/AppSrv01

#-------------------------------------------------------------------------
# Default Self-Signed Certificate Properties
# These properties are used to create a keystore when it does not exist with
# a self-signed certificate.  The properties com.ibm.ssl.keyStoreFileBased=true
# and com.ibm.ssl.trustStoreFileBased=true must be set to indicate a file-based
# keystore and truststore before they are created.
#-------------------------------------------------------------------------
com.ibm.ssl.defaultCertReqAlias=default
com.ibm.ssl.defaultCertReqSubjectDN=cn=${hostname},o=IBM,c=US
com.ibm.ssl.defaultCertReqDays=365
com.ibm.ssl.defaultCertReqKeySize=2048

...
...
					

com.ibm.ssl.rootCertSubjectDN=cn=${hostname},ou=Root Certificate, ou=myhostNode01,ou=myhostNode01Cell,o=IBM,c=US
com.ibm.ssl.rootCertValidDays=7300
com.ibm.ssl.rootCertAlias=root
com.ibm.ssl.rootCertKeySize=1024
					

Click Security > Global security > Custom properties

Figure 4.1. 

Change some properties mentioned above:

Figure 4.2. 

After changing the properties, complete the following actions:

If a default alias value already exists, the runtime appends _#, where the number sign (#) is a number that increments until it is unique in the keystore. ${hostname} is a variable that is resolved to the host name where it was originally created. The default expiration date of chained certificates is one year from their creation date.

The runtime monitors the expiration dates of chained certificates using the certificate expiration monitor. These chained certificates are automatically replaced along with the signer certificates when they are within the expiration threshold, which is typically 30 days before expiration. You can increase the default key size beyond 1024 bits only when the Java Runtime Environment policy files are unrestricted, that is, not exported.

Default keystore and truststore configurations for new Application Server processes

The following sample code shows the default SSL configuration for a application server node.

test317:/opt/IBM/WebSphere/AppServer/profiles/AppSrv01/config/cells/test317Cell01 # less security.xml


<repertoire xmi:id="SSLConfig_1370116587513" alias="NodeDefaultSSLSettings" managementScope="ManagementScope_1370116587513">
    <setting xmi:id="SecureSocketLayer_1370116587513" clientAuthentication="false" securityLevel="HIGH" enabledCiphers=""
    	jsseProvider="IBMJSSE2" sslProtocol="SSL_TLS" keyStore="KeyStore_1370116587513" trustStore="KeyStore_2"
    	trustManager="TrustManager_1370116587513" keyManager="KeyManager_1370116587513"/>
</repertoire>