SSL certificate in webMethods Software

Generating a SSL Private Key

1. Install webMethods Certificate Toolkit which can be found in version 6.5 image.
2. Run webMethods Certificate Toolkit
3. Use default keysize of 1024 bits
4. Label filename as MyEnterprise_PrivateKey.der

Generating the SSL Certificate Signing Request (CSR)

1. Run webMethods Certificate Toolkit
2. Select the private key generated above
3. Label the CSR filename as MyEnterprise_CSR.pem
4. Fill in the Server Information as required
5. Send the Certificate Signing Request (CSR) to an authorised person who deal commercially with VeriSign.

Extracting SSL certificates from VeriSign's response

1. Once the purchase of SSL Certificate is complete VeriSign will response with an email
2. The cert.p7b attachment received from verisign is a PKCS#7 file which contains the CA certificate and the signed/public key, you will need to extract them.
3. Save this attachment as MyEnterprise.p7b
4. Double-click on the MyEnterprise.p7b to inspect the certificates, note the expiration date
5. Double-click CA cetrificate (Issued To=www.verisign.com...)
6. Navigate to the Details tab
7. Click on the Copy to File button
8. Export file as DER encoded binary X.509 format, label filename as MyEnterprise_CA.cer
9. Rename MyEnterprise_CA.cer to MyEnterprise_CA.der
10. Double-click CA cetrificate (Issued To=b2b.jemena.com.au...)
11. Navigate to the Details tab
12. Click on the Copy to File button
13. Export file as DER encoded binary X.509 format, label filename as MyEnterprise_Signed.cer
14. Rename MyEnterprise_Signed.cer to MyEnterprise_Signed.der

Configure SSL certificate support for incoming transactions

1. Request MyEnterprise's private key, signed/public key and CA certificates from Security Team
2. Send MyEnterprise's signed/public key and CA certificates to CompanyA
3. Request CompanyA's signed/public key and CA certificates from CompanyA
4. Navigate to Reverse Invoke Server > IS Adminstration > Security > Ports > Gateway External
5. Upload MyEnterprise_PrivateKey.der and MyEnterprise_Signed.der onto Reverse Invoke Server under /IntegrationServer/config/cert/myent directory
6. Upload MyEnterprise_CA.der onto Reverse Invoke Server under /IntegrationServer/config/cert/cas directory
7. Under Listener Specific Credentials, select Protocol as HTTPS
8. Set Server's Certificate as config/cert/myent/MyEnterprise_Signed.der
9. Set Authority's Certificate as config/cert/cas/MyEnterprise_CA.der
10. Set Private Key as config/cert/myent/MyEnterprise_PrivateKey.der
11. Set Trusted Authority Directory as config/cert/cas
12. Navigate to Internal Server > IS Adminstration > Security > Certificates > Configure Client Certificates
13. Upload MyEnterprise_Sign.der onto Internal Server under /IntegrationServer/config/cert/com_a directory
14. Under Import Certificate, set Certificate Path as /IntegrationServer/config/cert/com_a/CompanyA_Signed.der
15. Set User as Administrator (recommend you create unique user on IS for easy supportability)
16. Set Usage as SSL Authentication
17. Click on Import Certificate

Configure SSL certificate support for outcoming transactions

1. Request v's private key, signed/public key and CA certificates from Security Team
2. Send MyEnterprise's signed/public key and CA certificates to CompanyA
3. Request CompanyA's signed/public key and CA certificates from CompanyA
4. Run webMethods Trading Networks Console, logon to Internal Server
5. Navigate Enterprise profile > Security > SSL Client
6. Under Certificate Chain, add MyEnterprise_Signed.der and MyEnterprise_CA.der
7. Set Private Key as MyEnterprise_PrivateKey.der
8. Save Enterprise profile
9. Upload MyEnterprise_CA.der and CompanyA_CA.der onto Internal Server under /IntegrationServer/config/cert/cas directory
10. Navigate to Internal Server > IS Adminstration > Security > Certificates > Edit Certificates Settings
11. Under Trusted Certificates, set CA Certificate Directory as config/cert/cas
12. Save changes

You might have notices the Outbound SSL Certificates section, why is that there? That's only required if you use pub.client:http service to invoke HTTPS URL, the IntegrationServer will act as a client.