Creating new keystores

The following topics provide information and instructions for creating new keystores:

• • To create a new keystore
  • Locations of keystore and truststores
  • Example of creating a new keystore

To create a new keystore

1. From the command prompt, change your working directory to
   <installationDirectory>\AtriumSSO\tomcat\conf. 
2. Create a new keystore by using a new password to secure the certificate:
   

   • For Microsoft Windows:

     keytool -genkey -alias tomcat -keyalg RSA -sigalg SHA1withRSA -keystore %CATALINA_HOME%\conf\keystore.p12 -validity 999 -keysize 1024 -storetype pkcs12 -storepass keystore_password -keypass keystore_password -providername JsafeJCE

   • For UNIX:

     keytool -genkey -alias tomcat -keyalg RSA -sigalg SHA1withRSA -keystore $CATALINA_HOME/conf/keystore.p12 -validity 999 -keysize 1024 -storetype pkcs12 -storepass keystore_password -keypass keystore_password -providername JsafeJCE
     
     

     Note

     Based on your requirements, you can use a keysize value of either 1024 or 2048.

3. After the keystore has been created, you must provide six parameters that form a distinguished name for a certificate associated with the key.
   
   • CN—Common Name of the certificate owner (usually the name of the host)
   • OU—Organizational Unit of the certificate owner
   • O—Organization to which the certificate owner belongs
   • L—Locality name of the certificate owner
   • ST—State or province of the certificate owner
   • C—Country of the certificate owner
4. Update the server.xml file with the new password for the keystore.

For details, see the Apache Tomcat documentation at http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html#SSL.

Locations of keystore and truststores

With the BMC Atrium Single Sign-On default installation, the keystore and truststores are in the following locations:

• Keystore:
  <installationDirectory>/tomcat/conf/keystore.p12
• Tomcat truststore:
  <installationDirectory>/tomcat/conf/cacerts.p12
• Java virtual machine (JVM) truststore:
  <installationDirectory>/jvm/jre/lib/security/cacerts

Example of creating a new keystore