Creating an Identity Keystore Using the utils.ImportPrivateKey Utility Creating a Trust Keystore Using the Keytool Utility

16-4 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management HOST cd certs 4. Run the utils.CertGen tool from the user-defined directory to create the certificates for both HOST. mycompany.com and VIP. mycompany.com. Syntax all on a single line: java utils.CertGen Key_Passphrase Cert_File_Name Key_File_Name [export | domestic] [Host_Name] Examples: IDMHOST1 java utils.CertGen Key_Passphrase IDMHOST1.mycompany.com_cert IDMHOST1.mycompany.com_key domestic IDMHOST1.mycompany.com IDMHOST2 java utils.CertGen Key_Passphrase IDMHOST2.mycompany.com_cert IDMHOST2.mycompany.com_key domestic IDMHOST2.mycompany.com IDMHOST2 java utils.CertGen Key_Passphrase ADMVHN.mycompany.com_cert ADMVHN.mycompany.com_key domestic ADMVHN.mycompany.com

16.3.2 Creating an Identity Keystore Using the utils.ImportPrivateKey Utility

Follow these steps to create an identity keystore on IDMHOST1: 1. Create a new identity keystore called appIdentityKeyStore using the utils.ImportPrivateKey utility. Create this keystore under the same directory as the certificates that is, ORACLE_BASEadmindomain_ name aserverdomain_namecerts.

2. Import the certificate and private key for IDMHOST1.mycompany.com,

IDMHOST2.mycompany.com and ADMVHN.mycompany.com into the Identity Store. Ensure that you use a different alias for each of the certificatekey pairs imported. Syntax all on a single line: java utils.ImportPrivateKey Keystore_File Keystore_Password Certificate_Alias_to_Use Private_Key_Passphrase Certificate_File Private_Key_File [Keystore_Type] Examples: IDMHOST1 java utils.ImportPrivateKey appIdentityKeyStore.jks Key_Passphrase appIdentityIDMHOST1 Key_Passphrase ORACLE_BASEadmindomain_ nameaserverdomain_namecertsIDMHOST1.mycompany.com_cert.pem ORACLE_ BASEadmindomain_nameaserverdomain_namecertsIDMHOST1.mycompany.com_key.pem IDMHOST1 java utils.ImportPrivateKey appIdentityKeyStore.jks Key_Passphrase appIdentityIDMHOST2 Key_Passphrase ORACLE_BASEadmindomain_ nameaserverdomain_namecertsIDMHOST2.mycompany.com_cert.pem ORACLE_ BASEadmindomain_nameaserverdomain_namecertsIDMHOST2.mycompany.com_key.pem IDMHOST1 java utils.ImportPrivateKey appIdentityKeyStore.jks Key_Passphrase Note: The Identity Store is created if none exists when you import a certificate and the corresponding key into the Identity Store using the utils.ImportPrivateKey utility. Setting Up Node Manager 16-5 appIdentityADMVHN Key_Passphrase ORACLE_BASEadmindomain_nameaserverdomain_ namecertsADMVHN.mycompany.com_cert.pem ORACLE_BASEadmindomain_ nameaserverdomain_namecertsADMVHN.mycompany.com_key.pem

16.3.3 Creating a Trust Keystore Using the Keytool Utility

Follow these steps to create the trust keystore on each host, for example IDMHOST1 and IDMHOST2: 1. Copy the standard Java keystore to create the new trust keystore since it already contains most of the root CA certificates needed. Oracle does not recommend modifying the standard Java trust keystore directly. Copy the standard Java keystore CA certificates located under the WL_HOMEserverlib directory to the same directory as the certificates. For example: IDMHOST1 cp WL_HOMEserverlibcacerts ORACLE_BASEadmindomain_ nameaserverdomain_namecertsappTrustKeyStoreIDMHOST1.jks 2. The default password for the standard Java keystore is changeit. Oracle recommends always changing the default password. Use the keytool utility to do this. The syntax is: HOST keytool -storepasswd -new New_Password -keystore Trust_Keystore -storepass Original_Password For example: IDMHOST1 keytool -storepasswd -new Key_Passphrase -keystore appTrustKeyStoreIDMHOST1.jks -storepass changeit 3. The CA certificate CertGenCA.der is used to sign all certificates generated by the utils.CertGen tool. It is located in the WL_HOMEserverlib directory. This CA certificate must be imported into the appTrustKeyStore using the keytool utility. The syntax is: HOST keytool -import -v -noprompt -trustcacerts -alias Alias_Name -file CA_File_Location -keystore Keystore_Location -storepass Keystore_Password For example: IDMHOST1 keytool -import -v -noprompt -trustcacerts -alias clientCACert -file WL_HOMEserverlibCertGenCA.der -keystore appTrustKeyStoreIDMHOST1.jks -storepass Key_Passphrase

16.3.4 Configuring Node Manager to Use the Custom Keystores