SSL/TLS

            SSL Configuring step for IBM Http Server 

Creating new SSL digital Certificate using iKeyman:

For the certificate you can use either a certificate that is signed by a certificate authority or you can also use a self-signed certificate.  Before creating a new certificate, you need to create a certificate store or Key Database.

• start the iKeyman utility: /IHS root/bin/ikeyman.sh
• From the Menu Bar select Key Database File > New.
• Choose the key database type as CMS
• Enter a file name for the new Key Database file you are creating
• Enter a Location for the location where you want to store the .kdb file

• Click OK
• After saving the key database file to the location specified, you are prompted to enter a password. This is the password that will be used to open the key database file in iKeyman in the future.
• make sure checkbox Stash the password to a file is enabled. this saves the encrypted password file as a .sth file in the same directory as the key database file.

• Now Click OK

Your Key Database file is Ready.

Now let's create a certificate request. I am using this URL for my site sslsupport.blogspot.com

• First, Open the KDB using ikeyman. This will show the key database contents.
• Click on the “down arrow” to the right, to display a list of three choices.

Select Personal Certificate Requests and click New

Now, a new window will pop up. here

you need to input details about the certificate and your organization.

Options:

• Key Size= 2048 for 256bit and 512bit
• Common Name= SiteName, [This is the name that the CA will register]
• Organization= Company Name
• Enter the name of a file in which to store the certificate request = This is the file (.arm) that will contain your request

Once you save the file (.arm) you are done with creating the request

You must now choose a CA and send them a “Certificate Request”

Once the CA has signed your certificate, generally they send you back the signed certificate through email.

• Take the information provided in the CAs email and copy it to a text file (notepad) and save it as IHS_Root/SSL/CertRcvd.arm
• Open the KDB file and choose Personal Certificates from the drop-down options [ check image3 for how-to]
• From the Personal Certificates section, click Receive, a pop-up window will come

Input the required data. Like  certificate name and location and click OK

Preparing IHS for SSL:

Open the httpd.conf file for editing and modify it to implement the following:

• For the host_name.domain, use the virtual host IP address or fully qualified domain name.
• Typically, port 443 is used for HTTPS protocol.
• The timeout values are given in seconds. Your values might be different.

Sample httpd.conf file for a UNIX computer:

    LoadModule ibm_ssl_module libexec/mod_ibm_ssl.so
AddModule mod_ibm_ssl.c
Listen 443

<VirtualHost host_name.domain:443>
ServerName host_name.domain
SSLServerCert certificate name
DocumentRoot “IHS_Root\docs”
SSLEnable
SSLClientAuth none
<\VirtualHost>

SSLDisable
Keyfile “path_to_keyfile_created”
SSLV2Timeout 100
SSLV3Timeout 1000

Restart IBM HTTP Server for the changes take effect.

Example SSL virtualhost :

<VirtualHost xxx.xxx.xx.xx:443>
ServerName test.com
SSLEnable
SSLClientAuth None
SSLServerCert mywebsite
<Directory “/home/www/website”>
Options Indexes
AllowOverride None
order allow,deny
allow from all
</Directory>
DocumentRoot “/home/www/website”
</VirtualHost>