Configure IBM WebSphere

This document provides information on how to configure the IBM WebSphere publishing profile to make it possible to install and publish certificates.

Requirements

• An IBM WebSphere server with SSL parameters activated.
• A certificate generated and signed by a CA. More information in How to create a request and How to sign a request. The certificate must have a private key, and the private key must have a password.
• A credential registered in Segura® with access to the IBM WebSphere server. More information on how to configure a credential in Segura® in How to configure a credential in Segura®.
• A device registered in Segura® for the IBM WebSphere server. More information in How to configure a device. If the device is not directly reachable, configure a Network Connector on the device before creating the publishing profile. The device's Network Connector always takes precedence over a global Network Connector.

Configure IBM WebSphere

To configure IBM WebSphere, see the following steps:

1. On Segura®, in the navigation bar, hover over the Products menu and select Certificate Manager.
2. In the side menu, select Publishing > Publishing profiles.
3. In the actions button, select IBM Websphere.
4. In the Settings tab, enter the following information:
   1. In the Profile name *, enter the profile's name.
   2. In the Credential username, enter the credentials' name.
   3. Optional: Check the Use a registered credential to access all devices option and, in the Access credential registered in the system, select the access credential registered in Segura® to be used.
5. Click Continue.
6. In the IBM Websphere tab, enter the following fields:

   1. In the Path of app_server_root websphere field, enter the path to the WebSphere application server root directory. This field is required to publish: without it, the publication fails because Segura® cannot find the Java installation.

   2. Optional: In the Server port field, enter the SSH port used to connect to the IBM WebSphere server. The default is 22. This port overrides the port of the device's SSH connectivity.

   3. In the Path keystore (KDB) field, enter the path to the keystore file (KDB) where certificates are stored. This field is required to publish.

   4. If you do not check the Stashed password? option, in the Password keystore field, select the password used to access the keystore. Without the keystore path, or without a password when the password is not stashed, the publication fails with the error For publication in Websphere it is necessary to send the keystore (KDB) information.

   5. Optional: In the Label Certificate field, enter the unique identifier of the certificate within the keystore.

   6. Optional: Check the Standard certificate? option to set the certificate being configured as the default for the server.

   7. Optional: Check the Stashed password? option to indicate that the keystore password is stashed, which allows access without manual entry.

   8. Optional: Check the Use sudo? option to run the commands on the server with sudo.

   9. Optional: In the Restart services after publication table, add the IBM HTTP Server instances to restart after the certificate is published. For each row, enter:

      • Service name: the only option is HTTPServer, the IBM HTTP Server.
      • Installation path: the default is /opt/IBM/HTTPServer.
      • Configuration file: the default is conf/this_instance.conf.
      • Service access port: the default is 443.

      Segura® restarts each service with <installation path>/bin/apachectl -f <configuration file> -k restart. This table does not restart the WebSphere Application Server.

7. Click Continue.
8. In the Devices tab, select the IBM WebSphere server.
   1. The device must be previously registered in Segura®.
   2. The Network Connector column shows Yes or No, depending on whether the device has its own Network Connector agent configured.
9. In the Review tab, review all information entered previously, including the Network Connector column, and click Save.

Certificate validation after publication

After Segura® publishes the certificate to the IBM WebSphere server, it validates the installation using the same Network Connector configured on the device. Publication and validation always follow the same network route.

Segura® validates only the services listed in the Restart services after publication table, on the Service access port of each row. If the table is empty, Segura® does not validate the installation. If one service fails validation, Segura® records the failure in the execution log and continues validating the remaining services.