Importing SSL certificates

For the Connections server to connect to Microsoft™ Exchange mail servers or HCL Domino® mail servers with self-signed certificates, you must import SSL certificates.

For Exchange servers

Use the keytool utility to import an SSL certificate into the cacerts keystore. Import the server’s SSL certificate into the cacerts keystore on the Connections server.

About this task

The keytool utility is in the path_to_WebSphere/WebSphere/AppServer/java/jre/bin directory. If this directory is not in the root user's PATH, then run the keytool utility by using the full path.

Note: In a clustered environment, certificates must be imported on all cluster member systems. The keytool must be run on each system.

Procedure

  1. Export the Microsoft™ Exchange SSL certificate to a file. To export, access the server from a browser and see the browser help for further instructions.
  2. Copy the certificate file to any location on the Connections server.
  3. On the Connections server, enter: cd path_to_WebSphere/WebSphere/AppServer/java/jre/lib/security
  4. Import the certificate into the keystore.
    Enter:

    keytool -import -alias KeyAlias -file path_to_certificate_file -keystore cacerts -storepass changeit

    Examples:

    • Windows™: C:\IBM\WebSphere\AppServer\java\jre\bin\keytool -import -alias ExchangeCert -file c:\tmp\ExchangeCert.cer -keystore cacerts -storepass changeit
    • Linux™: /opt/IBM/WebSphere/AppServer/java/jre/bin/keytool -import -alias ExchangeCert -file /tmp/ExchangeCert.cer -keystore cacerts -storepass changeit
    Note:
    • These file paths are examples and may not exist on your server.
    • The key alias can be any string that makes sense for the server configuration.
    • changeit is the default password for cacerts.

For Domino® servers

This is required only for Domino® servers that use self-signed certificates.

Procedure

  1. In the WebSphere® Application Server administrator console, click Security > SSL certificate and key management > Key stores and certificates > Cell Default trust store > Signer certificates.
  2. Click Retrieve from port.
  3. In the Host and Port fields, enter the host and SSL port used by your Domino server, respectively. The default SSL port is 443.
  4. Enter an alias in the Alias field.
  5. Click OK. Click Save. Click System administration > Nodes, and then select your Connections nodes, and then click Full Synchronize.
  6. Restart all Java™ virtual machines.