Understanding IBM cms keystore

ssl content-management-system keystore ibmhttpserver
user2770375 picture user2770375 · Oct 8, 2013 · Viewed 13.3k times · Source

I have an IBM HTTP Server which is already using cms keystore. When deployment team created the keystore of type cms the ikeyman tool generated 4 files (key.kdb, key.sth, key.crl, key.rdb). I don't know which one is the keystore and what are the other files exactly. I need to know what they are as i'm recently almost working with IBM products. I hear that the key.sth is a stash file but i don't know it's meaning acctually. I would really appreciate if anyone can help me in that

Answer

covener picture covener · Oct 27, 2013

You should treat them as an atomic set of files and never copy a subset. You always reference just the *.kdb from configuration or with the certificate management tools.

The *.kdb contains the private keys, certificiates, and CA's. It is encrypted with a password that can be stashed in the *.sth file.

The *.rdb contains information about outstanding certificate requests. It's critical that you maintain this 1:1 with the KDB.

The *.crl contains revocation info. It is generally not interesting, unless it gets corrupted/mismatched in which case it can cause runtime errors.

The *.sth is a way to store an obfuscated password to a file. Runtime tools can use this password instead of prompting for one interactively. It obviously has to be protected if you have private keys in the corresponding KDB.

The set all put together is similar to a PKCS12 file in other tools.

Related questions

How to create a self-signed certificate with OpenSSL

I'm adding HTTPS support to an embedded Linux device. I have tried to generate a self-signed certificate with these steps: openssl req -new > cert.csr openssl rsa -in privkey.pem -out key.pem openssl x509 -in cert.csr -out …

Read More
Getting Chrome to accept self-signed localhost certificate

I have created a self-signed SSL certificate for the localhost CN. Firefox accepts this certificate after initially complaining about it, as expected. Chrome and IE, however, refuse to accept it, even after adding the certificate to the system certificate store …

Read More
Resolving javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed Error?

Edit :- Tried to format the question and accepted answer in more presentable way at mine Blog Here is the original issue. I am getting this error: detailed message sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.…

Read More