Scribd
Upload
163 views

SSL Config Was61 Ihs

1) The document describes how to configure IBM HTTP Server 6.1 with SSL to enable secure communication with WebSphere Application Server 6.1. This includes generating a self-signed certificate, configuring the httpd.conf file to define a HTTPS virtual host, and testing the SSL connection. 2) Key steps are creating a key ring database to store the certificate, modifying the httpd.conf file to load the SSL module and define the HTTPS virtual host, and verifying the connection works over HTTPS. 3) The process also involves configuring WebSphere Application Server's default virtual host to listen on port 443 and propagating the keystore file so the application server can communicate securely with the web server.

Uploaded by

Esteban Adrian Lopez Fajardo
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as PDF, TXT or read online on Scribd
163 views

SSL Config Was61 Ihs

1) The document describes how to configure IBM HTTP Server 6.1 with SSL to enable secure communication with WebSphere Application Server 6.1. This includes generating a self-signed certificate, configuring the httpd.conf file to define a HTTPS virtual host, and testing the SSL connection. 2) Key steps are creating a key ring database to store the certificate, modifying the httpd.conf file to load the SSL module and define the HTTPS virtual host, and verifying the connection works over HTTPS. 3) The process also involves configuring WebSphere Application Server's default virtual host to listen on port 443 and propagating the keystore file so the application server can communicate securely with the web server.

Uploaded by

Esteban Adrian Lopez Fajardo
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 17

Configure IHS 6.1 with SSL and WebSphere Application Server 6.

1) Create a new directory to hold the key ring.


a) Create the directory <ihs_root>\ssl.
2) Open iKeyman in <ihs_root>\bin
a) Bring up IHS’s Ikeyman. This can be done through either a
command-line window or using Start —> Programs —> IBM
HTTP Server 6.1 —> Start Key Management Utility.
b) The command line can be executed from the <ihs_root>\bin
directory:
ikeyman.bat
4) Create a key ring
a) Create a new key ring by selecting Key Database File —>
New
b) Use type CMS, file name ihsKeyring.kdb and a location of
<ihs_root>\ssl.

Click OK.
5) When prompted for a password for the key ring, enter and confirm
was1edu as the password. If desired, modify the expiration time.
Check the “Stash the password to a file” check box. Click OK
and OK again for the informational box.

4) Create a new self-signed certificate.


a) In Ikeyman, select Create —> New Self-Signed
Certificate and enter

Example Description
Key Label IHSCertificate
Common Name <domain_name>
Organization Royal Cyber Inc.
Organization Unit IBM WebSphere
Locality bolingbrook
State/Province IL
Zipcode 60563
5) Click OK
6) Exit iKeyman

List the contents of the directory <ihs_root>\ssl\ and verify that the
following files were created:

ihsKeyring.kdb
ihsKeyring.sth
ihsKeyring.crl
ihsKeyring.rdb
Configure a Virtual Host on IHS for HTTPS

This section of the document modifies the httpd.conf in order to define


the required setting to enable SSL for IBM HTTP Server. This includes
loading the SSL module, defining a listener port, defining a virtual host
and enabling SSL.

1) Add your domain name <domain_name> to hosts file.


a) Edit C:\Winnt\System32\Drivers\etc\hosts
b) Add a line at the bottom of the hosts file for
<domain_name> in our case it w2k3was61.rc.net and use your
system’s IP address.
c) Save the file.
2) Backup the httpd.conf.
a) Since changes are about to be made to the httpd.conf, it
would be a good idea to make a backup of it before starting.
Copy the httpd.conf in <ihs_root>\conf to httpd-
backup.conf.

3) Add Virtual Host definition for HTTPS. This allows for the
definition of HTTPS on a separate virtual host from HTTP.

a) Edit the httpd.conf in <ihs_root>\conf.


b) Load the SSL module by adding the following line after
where most of the other Load Modules are done:

LoadModule ibm_ssl_module modules/mod_ibm_ssl.so


c) Add the following lines to httpd.conf to configure the
virtual host and SSL. Make sure to use the correct ServerName
for your machine (was61hostXX) and the appropriate
DocumentRoot and Keyfile. Place these lines near the very
bottom of the httpd.conf, after the VirtualHost example and
before the loading of the WebSphere plug-in module.

Listen 443
<VirtualHost w2k3was61.rc.net:443>
ServerName w2k3was61
DocumentRoot “C:/Program Files/IBM/HTTPServer/htdocs/en_US”
SSLEnable
Keyfile “C:/Program Files/IBM/HTTPServer/ssl/ihsKeyring.kdb”
SSLV2Timeout 100
SSLV3Timeout 1000
</VirtualHost>
SSLDisable

d.Save your updates and exit the editor


Testing the SSL Connection

1) Restart the IBM HTTP Server process so that the new httpd.conf
settings take effect

a) Using the Window Services, select the IBM HTTP Server


6.1 service from its context menu select Restart

b) Verify that the IBM HTTP Server process is running by


checking the system process list. If IBM HTTP Server failed to
start, check the <ihs_root>\logs\error.log and
<profile_root>\logs\<webserver>\http_plugin.log for the cause.
2) Connect to IBM HTTP Server using HTTPS
a) First, verify that the Web server is actually running.
Connect to the following site:

http://w2k3was61/
b) Now that the Web server is known to be running, enter the
following URL to verify that HTTPS is working (notice, the only
different is that the HTTP protocol was replaced with HTTPS):

https://w2k3was61/

c) There should be a challenge regarding the certificate since


it is self signed
e) The front page for IBM HTTP Server should now be
displayed having used HTTPS.

That takes care of talking to the Web server with HTTPS. But, in order
for the HTTPS connections to be able to reach the application server,
port 443 needs to be enabled on the application server’s virtual host.
WebSphere Application Server V6.1 automatically adds port 443 to the
default virtual host, but it would be a good idea to verify that it is
there.
1) Using the administrative console, select Environment —>
Virtual Hosts.
2) Click default_host.
3) On the right, under Additional Properties, click Host Aliases
4) Verify that port 443 is one of the ports listed. If it is not, you
should add it.
5) Since this document has configured the IBM HTTP Server to be a
managed server, it is possible to propagate the correct version
of the keyfile through the console. Using the administrative
console, navigate to Servers —> Web servers. Click your Web
server, and then under the Additional Properties click Plug-in
properties.

6) In the Plug-in key store file name, accept the default of


plugin-key.kdb and click Copy to Web server key store
directory. By checking the new date and time stamps of the
directory entries, it is possible to verify that the key rings were
in fact updated.
7) Test the HTTPS connection from the browser, through IBM HTTP
Server, and back to WebSphere Application Server using snoop.
a) Ensure that the WebSphere Application Server profile1 is
running.
b) Restart the IBM HTTP Server.
c) Using a browser, verify that snoop is reachable with the
following address:
http://w2k3was61/snoop
d) Now try snoop using HTTPS, using the following URL
(make sure to use HTTPS):
https:// w2k3was61/snoop

e) Accept the certificate if prompted.

Notice that the snoop servlet is showing that the connection was made
via HTTPS.

You might also like