How to Install Certificates on IBM Websphere

Before being able to enable SSL on WebSphere, you need to have your own certificate. This certificate can be a self-certificate for testing purpose but in any production case, you should have a certificate issued by a Trusted CA. The following steps describe how to get your own certificate and later how to configure WebSphere to use it.

Installing a certificate chain

Before you can add your certificate into the keystore, you must first include the certificates chain. You must install the following public certificates:

Root (AddTrustExternalCARoot.crt)	Root
Primary Server certificate(UTNAddTrustServerCA.crt)	PrimServer
Server certificate	Server

You can add the certificates chain from the Signer Certificates screen as shown below:

Click on the Add button. A dialog box will appear where you have to enter the data, the Certificate file name (the certificate file you received) and its location. Once all of this information is entered click on OK.

Installing your site certificate

You can import the site certificate into your keystore easily. After opening the IBM Key Management console, please select the option 'Personal Certificates' in the drop down within the 'Key Database Content' area as shown in the following screen:

Once you've selected 'Personal Certificates', please click on the 'Receive' button. A dialog box will appear in which you must enter the data required, the certificate file name (the certificate file you received) and its location. Once all of this information is entered click 'OK'. This will configure your keystore correctly.

Enabling SSL

Once your keystore has been successfully configured with your certificate, you can enable SSL in WebSphere Application Server.