Knowledge Base

How to Generate a CSR and Install a SSL Certificate on IBM HTTP Server?

Updated on April 3, 2026

Overview

This article explains how to create a Certificate Signing Request (CSR) and install an SSL certificate on an IBM HTTP Server using the IBM Key Management utility (iKeyman).

The process consists of two main stages:

Generating the CSR

Installing the SSL certificate

Part 1: Generating a CSR on IBM HTTP Server

IBM HTTP Server uses the iKeyman tool (IBM Key Management Utility) along with GSKit to generate the CSR.

Prerequisites

Before proceeding, ensure the following:

IBM HTTP Server is installed.

GSKit is available on the system.

The iKeyman utility can be launched on the server.

Step 1: Create a Key Database File (.kdb)

The key database file will store the certificate and its associated keys.

Launch the iKeyman utility.

On Windows: Navigate to
Start → Programs → IBM HTTP Server → Key Management (iKeyman).

On Unix/Linux: Run the command:

ikeyman

From the main menu, select Key Database File.

Click New to create a new database.

Enter the following details:

File Name
Provide a name for the database file (for example: server.kdb).

Location
Choose the directory where the database file will be stored.

Create a secure password for the database.

Enable the option to stash the password, which will generate a .sth file used by the server to access the key database automatically.

Click OK to complete the database creation.

Step 2: Generate the CSR

After creating the key database, you can proceed with generating the CSR.

Open the newly created .kdb file using the iKeyman utility.

In the Key Database Content section, expand the drop-down menu.

Select Personal Certificate Requests.

Click New to begin creating a CSR.

Enter the required certificate details:

Key Label
A recognizable name for the certificate (for example: yourdomain_ssl).

Key Size
Use 2048 bits for the key length.

Common Name (CN)
Enter the Fully Qualified Domain Name (FQDN) you want to secure.
Example: www.yourdomain.com

Organization (O)
The full legal name of your organization.

Organizational Unit (OU)
This field is optional and often deprecated. You may enter NA if not required.

Locality (L)
City where your organization operates.

State/Province (ST)
Full name of the state or region.

Country (C)
Two-letter country code (example: US, UK, IN).

Specify a name for the CSR output file.

Save the file (usually with .arm or .csr extension) in the same directory as the key database.

Submitting the CSR and SSL issuance

Open the CSR file using a text editor such as Notepad and copy the entire contents.

Login to store.sectigo.com > navigate to the order > click on setup > submit the CSR and other necessary details > perform the validation to get the SSL issued.

Part 2: Installing the SSL Certificate on IBM HTTP Server

After the SSL certificate is issued, you will receive a certificate bundle from the Certificate Authority.

This bundle usually contains: