Replace the self-signed certificate with the trusted CA certificate issued by the CA

Setting Up Your Environment for Policies 10-17 the csf-key property to App2.credentials. For more information, see Attaching Client Policies Permitting Overrides on page 8-21. Note that in both cases, the usernames and passwords must represent valid users in the OPSS identity store. A password credential can store a username and password. A generic credential can store any credential object. The CSF configuration is maintained in the jps-config.xml file in the domain-home configfmwconfig directory. When you configure the Oracle WSM keystore using Fusion Middleware Control, as described in Configuring the Oracle WSM Keystore on page 10-10, the aliases and passwords that you specify are securely stored in the credential store. If, however, you add other aliases to the keystore, or you need to add authentication credentials for a client, you need to ensure that they are configured and stored in the credential store also, as described in the following section. Adding Keys and User Credentials to the Credential Store You can use Fusion Middleware Control or WLST commands to add keys and user credentials to the credential store. Both methods are described in the following procedures. Using Fusion Middleware Control Follow these steps in Fusion Middleware Control to add keys and certificates to the credential store:

1. In the Navigator pane, expand WebLogic Domain to show the domain for which

you need to configure the keystore. Select the domain.

2. From the WebLogic Domain menu, select Security then Credentials.

Note: The example procedures in this section describe how to add user credentials for the basic.credentials key as described above, and the example ServiceA and ServiceB aliases described in Advanced Setup Considerations on page 10-8. In your own environment, you should use aliases and passwords that are appropriate for your configuration. Before adding key credentials to the credential store, ensure that the private keys and aliases exist in the keystore. You can create them using commands such as the following: keytool -genkeypair -keyalg RSA -alias ServiceA -keypass welcome1 -keystore default-keystore.jks -storepass welcome1 -validity 3600 keytool -genkeypair -keyalg RSA -alias ServiceB -keypass welcome3 -keystore default-keystore.jks -storepass welcome1 -validity 3600 For more information about the keystore, see Generating Private Keys and Creating the Java Keystore on page 10-9. 10-18 Oracle Fusion Middleware Security and Administrators Guide for Web Services Figure 10–4 Credential Store Menu The Credentials page is displayed, as shown in Figure 10–5 . Figure 10–5 Credential Store Provider Configuration Page Note that in this configuration, the oracle.wsm.security credential map already exists in the credential store. This credential map was created when you configured the Oracle WSM keystore as described in Configuring the Oracle WSM Keystore on page 10-10. If you do not see this credential map in your configuration, you can create it by clicking the Create Map button, and entering oracle.wsm.security in the Map Name field. 3. Optionally, expand the oracle.wsm.security map in the Credential table to view the keys that have been configured in the map. Figure 10–6 illustrates a sample Oracle WSM credential store configuration. Setting Up Your Environment for Policies 10-19 Figure 10–6 Keys Configured in Oracle WSM Credential Map You can edit the keys in the credential map by selecting the key and clicking Edit. Make sure that any changes you make in the credential store are consistent with the definition of the key in the Oracle WSM Java keystore.

4. Click Create Key to create new entries in the oracle.wsm.security credential

map, for example for the ServiceA and ServiceB aliases. The Create Key dialog box appears, as shown in Figure 10–7 . Figure 10–7 Create Key Dialog Box

a. From the Select Map menu, select the map name oracle.wsm.security if it is

not already selected.

b. In the Key field, enter csfServiceA to create a key-value pair to access the

key store.

c. From the Type menu, select Password.

d. In the User Name field, enter the alias name that you specified for the private

key in the keystore, for example ServiceA.

e. In the Password and Confirm Password fields, enter the password that you

specified for the alias in the keystore, for example welcome1.

f. In the Description field, enter a description of for the entry, for example, Key

for ServiceA.