Obtaining keystores and importing them into the IdP server

Obtain keystores for the IdP server and for all SPs you want to include in the federation. You can generate the keystores using the Java™ keytool utility, or you can obtain them from a certificate authority.

If you generate keystores using the keytool utility, here is a typical workflow for this task, with example commands. In the examples, the Java™ 6 keytool path is C:\Program Files (x86)\Java\jre7\bin\keytool.

• The IdP administrator generates a keystore for the IdP server and exports the certificate.

  
  # Generate IdP JKS from keytool
  c:\temp> "keytool_path\keytool" -genkey -keyalg RSA -alias idp 
  -keystore idp.jks -storepass idp001 -validity 360 -keysize 2048
  # Export IdP certificate from JKS
  c:\temp> "keytool_path\keytool" -export -alias idp -file idp.cer 
  -keystore idp.jks
  

• An SP administrator generates a keystore and exports it.

  
  # Generate Service Provider JKS from keytool
  c:\temp> "keytool_path\keytool" -genkey -keyalg RSA -alias SP_1 
  -keystore SP_1.jks -storepass SP001 -validity 360 -keysize 2048
  # Export Service Provider certificate from JKS
  c:\temp> "keytool_path\keytool" -export -alias SP_1 -file SP_1.cer 
  -keystore SP_1.jks
  

  The SP administrator then sends the certificate to the IdP administrator.

• The IdP administrator imports the SP certificate into the IdP server.

  
  # Import Service Provider certificate into IdP JKS
  c:\temp> "keytool_path\keytool" -import -alias SP_1 
  -trustcacerts -file SP_1.cer -keystore idp.jks