Liberty profile: Keystores

An example of JKS keystore configuration is as follows:

     <keyStore id="sampleJKSKeyStore"
           		location="MyKeyStoreFile.jks"
           		type="JKS" password="myPassword" />

An example of JCEKS keystore configuration is as follows:

    <keyStore id="sampleJCEKSKeyStore"
           		location="MyKeyStoreFile.jceks"
           		type="JCEKS" password="myPassword" />

PKCS12 keystore can be used when using the IBM JRE. An example of PKCS12 keystore configuration is as follows:

    <keyStore id="samplePKCS12KeyStore"
           		location="MyKeyStoreFile.p12"
           		type="PKCS12" password="myPassword" />

CMS keystore can be configured when using the IBM JRE but some special configuration is required. The CMS provider is not available by default on the IBM JRE, therefore it must be added to the provider list in the java.security file of the JRE. In the following example, the com.ibm.security.cmskeystore.CMSProvider class is added to the end of the list. Make sure the provider number is correct for where it is put in the provide list. The Liberty profile does not use the CMS keystore stash file to gain access to the keystore.

  security.provider.1=com.ibm.jsse2.IBMJSSEProvider2
	security.provider.2=com.ibm.crypto.provider.IBMJCE
	security.provider.3=com.ibm.security.jgss.IBMJGSSProvider
	security.provider.4=com.ibm.security.cert.IBMCertPath
	security.provider.5=com.ibm.security.sasl.IBMSASL
	security.provider.6=com.ibm.xml.crypto.IBMXMLCryptoProvider
	security.provider.7=com.ibm.xml.enc.IBMXMLEncProvider
	security.provider.8=org.apache.harmony.security.provider.PolicyProvider
	security.provider.9=com.ibm.security.jgss.mech.spnego.IBMSPNEGO
	security.provider.10=com.ibm.security.cmskeystore.CMSProvider

To use the CMS keystore, the configuration in the server.xml file is as follows:

    <keyStore id="sampleCMSKeyStore" 
              password="myPassword"
              location="MyKeyStoreFile.kdb"
              provider="IBMCMSProvider"
              type="CMSKS"/>