Page History

...

You can Follow the recommendations given below when you set up several keystores with separate key pairs and certificates for the above use cases in your system. It is recommended to maintain the following keystores:your keystores. 

• Maintain one primary keystore for encrypting sensitive internal data such as admin passwords and any other sensitive information found at both product-level and product feature-level configurations/configuration files.

• Maintain another secondary keystore, containing the server’s public key certificate for authenticating communication over SSL/TLS (for both Tomcat and Axis2 level HTTP connections).

• If your deployment contains multiple products, instances of the same product must use the same keystore for SSL. Different products can use different keystores for SSL, but it is not mandatory.

• It is recommended to use a CA-signed keystore for SSL communication; however, this is not mandatory. Even a self-signed certificate may suffice if it can be trusted by the clients.

• The keystore used for SSL must contain the same password for the Keystore and private key due to a Tomcat limitation.

• The primary keystore used for admin passwords and other data encryption requirements can be a self-signed one. There is no value added by using a CA-signed keystore for this purpose, as it is not used for any external communication.

• The primary keystore's public key certificate must have the Data Encipherment key usage to allow direct encipherment of raw data using its public key. This key usage is already included in the default self-signed certificate.

• Optionally, you can set up separate keystores for message-level data encryption in WS-Security.

...