 |
|
Managed PKI for SSL Support
|
CSR Generation for IBM HTTP Server
To generate a CSR, you need to create a key
pair for your server. These two items comprise a digital certificate
key pair and cannot be separated. If you lose your public/private key
file or your password and generate a new one, your SSL Certificate will
no longer match. You will have to request a new SSL Certificate from
your Managed PKI for SSL Administrator.
VeriSign recommends that you contact the IBM
HTTP Server vendor for additional information.
Step 1: Generate a Key Pair
- Open
the IKEYMAN
utility (in Windows NT click Start -> Programs -> IBM HTTP Server
-> Start Key Management Utility)
- Select Key Database
File from the menu bar.
- Click
on New
- File
name= the name of the new key database file
- Location=
the location on the hard drive for the .kdb file
- (On NT
this is usually the /IBM Http Server/ssl directory)
- Save
the file to the location specified and enter a password at the prompt.
(This password will be used to open the .kdb file in IKEYMAN.)
- Click
on the box: stash the password to a file? (Encrypts the password and saves
as an .sth file in the same directory as the .kdb file.)
- Click
on OK.
Step 2: Generate a Certificate Signing Request
- Open
the key database file (.kdb) using the IKEYMAN utility.
- Look
for the section entitled: Key database content in the middle of the screen.
- Click
on the down arrow to the right to display the three choices.
- Select Personal Certificate
Requests.
- Key label
= the name of the certificate to identify it in IKEYMAN
- Key size
= 1024 for 128bit, 512 for 56bit
- Common
name = SiteName, ex. www.robo.com
- Organisation
= company name (See terms below for more information about common name
and organisation.)
- Enter
the name of a file (.arm) in which to store the certificate request.
(A simple text file that can be opened in any text editor.)
- Save
the file (.arm) in the same directory as the (.kdb) file.
- Go to
your MPKI for SSL enrolment pages. (Your administrator will provide
you with this URL.)
Terms Defined
Common Name
The Common Name is the Host + Domain Name.
It looks like "www.company.co.uk" or "company.co.uk".
VeriSign certificates can only be used on Web
servers using the Common Name specified during enrolment. For example,
a certificate for the domain "domain.co.uk" will receive a
warning if accessing a site named "www.domain.co.uk" or "secure.domain.co.uk",
because "www.domain.co.uk" and "secure.domain.co.uk"
are different from "domain.co.uk".
Organisation Information
- If your company
or department has an &, @, or any other symbol using the shift key
in its name, you must spell out the symbol or omit it to enrol.
- The “Org Unit” field
is the name of the department or organisation unit making the request.
- The Locality field
is the city or town name, for example: Guildford.
- Do not abbreviate
the county name, for example: Surrey.
- Use the two-letter
code without punctuation for country, for example: GB.
Contact Information
Your Managed PKI for SSL Administrator will
be responsible for issuing the certificate to you after your enrolment
has been completed. Please contact them for assistance.
|
|
|
