Knowledge Base

How to Generate a CSR and Install an SSL Certificate on IBM HTTP Server

Updated on August 14, 2026

Overview

By the end of this article, you will have a key database file on your IBM HTTP Server that holds a working SSL certificate, and the server will serve HTTPS traffic using that certificate.

The article covers four things in order:

Creating the key database file (.kdb)
Generating the Certificate Signing Request (CSR)
Importing the signer certificates (root and intermediate certificates)
Installing the issued server certificate

All work is completed in the IBM Key Management utility (iKeyman), the graphical tool shipped with IBM HTTP Server and supported by Global Security Kit (GSKit).

A final restart of IBM HTTP Server activates the certificate.

Prerequisites

Confirm the following before you begin:

IBM HTTP Server is installed on the target machine.
Global Security Kit (GSKit) is available on the same machine.
The IBM Key Management utility (iKeyman) can be launched, and you have permission to write files to the directory where the key database will be stored.

Part 1: Generate the CSR

Step 1: Create the Key Database File

Create the key database file first because it stores the private key that the CSR and final certificate are bound to.

Launch iKeyman.
- Windows: Start → Programs → IBM HTTP Server → Key Management (iKeyman)
- Linux/Unix: Run ikeyman
Select Key Database File, then click New.
Enter a file name such as server.kdb.
Specify the storage location.
Create a strong database password.
Enable Stash the password to a file.
Click OK.

You now have a .kdb file and a matching .sth file.

Step 2: Generate the CSR

Generate the Certificate Signing Request (CSR) from the same key database so it remains linked to the private key.

Open the .kdb file and enter the password.
Select Personal Certificate Requests from the Key Database Content menu.
Click New.
Complete the certificate details shown below.
Save the file using a .arm or .csr extension.

Field	What to Enter
Key Label	A recognizable name such as `yourdomain_ssl`.
Key Size	2048 bits
Common Name (CN)	The FQDN to secure, for example www.yourdomain.com.
Organization (O)	Full legal organization name.
Organizational Unit (OU)	Optional. Enter NA if not required.
Locality (L)	Organization city.
State/Province (ST)	Full state or region name.
Country (C)	Two-letter country code such as US, GB, or IN.

Step 3: Submit the CSR to Sectigo

Open the CSR file in a text editor and copy the entire contents.
Sign in to Sectigo Store.
Open the relevant order and click Setup.
Paste the CSR and complete the remaining details.
Complete the required validation process.

Part 2: Install the SSL Certificate

Step 4: Extract the Certificate Files

After certificate issuance, download and extract the certificate bundle.

Verify that it contains:

Root certificate
Intermediate certificate
Server certificate issued to your domain

Step 5: Import the Root and Intermediate Certificates

Import both certificates as signer certificates to build the trust chain.

Launch iKeyman.
Open the .kdb file and enter the password.
Select Signer Certificates.
Click Add and import the root certificate.
Click Add again and import the intermediate certificate.

Import the root certificate before the intermediate certificate to ensure the certificate chain is built correctly.

Step 6: Install the Server Certificate

Select Personal Certificates.
Click Receive.
Browse to the server certificate file, such as yourdomain.crt.
Click OK.

The certificate is automatically associated with the matching private key generated during CSR creation.

Step 7: Restart IBM HTTP Server

Restart IBM HTTP Server so it reloads the key database and begins using the newly installed certificate.

How to Verify the Installation Was Successful

Open the .kdb file in iKeyman.
Select Personal Certificates.
Confirm the certificate appears under the configured key label.
Open your HTTPS website in a browser.
Verify that:
- The connection is secure.
- The Common Name (CN) matches your domain.
- Sectigo appears as the issuer.

Troubleshooting

Issue

The certificate does not appear under Personal Certificates after clicking Receive.

Cause

The certificate does not match the CSR generated from the current key database.

Solution

Verify that the certificate was issued from the CSR generated in this .kdb file. If not, generate a new CSR and request a certificate reissue.

Issue

IBM HTTP Server cannot open the key database or prompts for a password during startup.

Cause

The stash file is missing or unavailable.

Solution

Verify that the .sth file exists in the same directory as the .kdb file. If necessary, reopen the database and stash the password again.

Issue

The browser reports a certificate chain error or untrusted issuer.

Cause

The root certificate, intermediate certificate, or both were not imported.

Solution

Check the Signer Certificates section and import any missing certificates. Restart IBM HTTP Server afterward.

Frequently Asked Questions

What is a CSR?

A Certificate Signing Request (CSR) is an encoded block of text containing your organization details, domain information, and public key. It is submitted to a Certificate Authority (CA) for certificate issuance.

How do I generate a CSR on IBM HTTP Server?

Open iKeyman, create or open a key database, select Personal Certificate Requests, click New, enter the certificate details, and save the request as a .csr or .arm file.

What should I do if the certificate does not appear under Personal Certificates?

Verify that the certificate was issued using the CSR generated from the same key database. If not, generate a new CSR and request a certificate reissue.