This documentation is for WSO2 Carbon 4.2.0. View documentation for the latest release.
Configuring Primary/Registry Keystores - Carbon 4.2.0 - WSO2 Documentation
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 55 Next »

WSO2 Carbon uses several keystores to power the servlet transport and to encrypt other confidential information such as administrator passwords. The carbon.xml file in the <PRODUCT_HOME>/repository/conf directory of your product contains the configurations for the primary keystore and the registry keystore.

The default keystore named wso2carbon.jks can be found in the <PRODUCT_HOME>/repository/resources/security directory of your product pack.

Note that when keystores are configured, two keystore passwords are specified in the relevant .xml file:

  • The <Password> element indicates the password of the keystore file.
  • The <KeyPassword> element points to the password required to access the private key.

Primary Keystore

The primary keystore mainly stores the keys certifying SSL connections to Carbon servers and the keys for encrypting administrator passwords as well as other confidential information. The Keystore element in the carbon.xml file is used to configure the primary keystore as given below. Note that in this example, the default keystore in your product pack (wso2carbon.jks) is used as the primary keystore.

<KeyStore>
	<Location>${carbon.home}/resources/security/wso2carbon.jks</Location>
	<Type>JKS</Type>
	<Password>wso2carbon</Password>
	<KeyAlias>wso2carbon</KeyAlias>
	<KeyPassword>wso2carbon</KeyPassword>
</KeyStore>

Registry Keystore

RegistryKeyStore is a separate keystore element configurable in the carbon.xml file. This configuration applies for the keystore which stores the keys that certify encrypting/decrypting meta data to the registry. Therefore, using the registry keystore in addition to the primary keystore in the carbon.xml file allows you to maintain a separate keystore for the purpose of encrypting/decrypting meta data to the registry. The registry keystore configuration which needs to be added in the carbon.xml file is as given bellow. Note that in this example, we are referring to the default keystore in the product pack (wso2carbon.jks) as the registry keystore.

<RegistryKeyStore>
            <!-- Keystore file location-->
            <Location>${carbon.home}/repository/resources/security/wso2carbon.jks</Location>
            <!-- Keystore type (JKS/PKCS12 etc.)-->
            <Type>JKS</Type>
            <!-- Keystore password-->
            <Password>wso2carbon</Password>
            <!-- Private Key alias-->
            <KeyAlias>wso2carbon</KeyAlias>
            <!-- Private Key password-->
            <KeyPassword>wso2carbon</KeyPassword>
</RegistryKeyStore>
  • No labels