{"id":5669,"date":"2016-04-13T13:54:02","date_gmt":"2016-04-13T05:54:02","guid":{"rendered":"http:\/\/rmohan.com\/?p=5669"},"modified":"2016-04-13T13:54:02","modified_gmt":"2016-04-13T05:54:02","slug":"gskcmd-command","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=5669","title":{"rendered":"gskcmd command"},"content":{"rendered":"

The following instructions will guide you to create csr and import the signed crt in the default kdb of IHS.<\/p>\n

Step 1: Finding the Kdb<\/h3>\n
The default Kdb will be present in the IHS installation path. Find the key.kdb and take a back up before executing the commands.<\/div>\n

Step 2: Creation of Csr<\/h3>\n
Use the following command to create the csr.<\/div>\n
<\/div>\n
gskcmd will be present in the bin folder of IHS. gsk7cmd can be used based on the version of IHS.<\/div>\n
<\/div>\n
.\/gskcmd -certreq -create -db \/opt\/IHS\/SSL\/key.kdb -pw WebAS -label lablename -dn “CN=hostname, OU=ou name, O=organization, L=Location, ST=state, C=country code” -size 2048 -file filename.csr<\/b><\/div>\n
<\/div>\n
-db is the key.kdb path<\/div>\n
-pw is the kdb password, The defualt password is WebAS<\/div>\n
-label is any name that you choose the certificated to be labled.<\/div>\n
-dn is the domain information<\/div>\n
<\/div>\n
CN = Common name (dns name of the name with which you are trying to use https:\/\/hotname protocol)<\/b><\/div>\n
OU = Organization unit name (ex: IT services)<\/b><\/div>\n
O = Organization that you are working in, or to whom you are configuring the certificate.<\/b><\/div>\n
L = Location (ex: Germany)<\/b><\/div>\n
C = 2 digit country code (ex: GE)<\/b><\/div>\n
<\/div>\n
This command will create a filename.csr with the information that you have provided.<\/div>\n
<\/div>\n

Step 3: Certificate request<\/h3>\n
The csr has to be sent to the certificate signing authorities like verisign, Thwate or Geotrust. They will create a crt file and send the server certificate along with the root and intermediate certificates.<\/div>\n

Step 4: Importing the server certificate<\/h3>\n

Following command will import the server certificate to the kdb file.<\/p>\n

Save the certificate file received from the signing authority as server.crt and execute the following command.<\/p>\n

gskcmd -cert -receive -file server.crt -db \/opt\/IHS\/SSL\/key.kdb -pw WebAS -label servercertificate -format ascii<\/b><\/p>\n

This command will import the server certificate.<\/p>\n

Step 5: Set the server certificate to default<\/h3>\n

Following command will make the server certificate as default. When you access the https protocol of the website, The default certificate will be choosen.<\/p>\n

gskcmd -cert -setdefault -label servercertificate -db \/opt\/IBM\/HTTPServer\/SSL\/key.kdb<\/b><\/p>\n

Step\u00a0 6: Importing the CA\/Intermediate certificate<\/h3>\n

Along with the server certificate, The signing authority will send the intermediate certificate, This certificate has to be imported to prevent the ssl handshake errors.<\/p>\n

Save the Intermediate certificate as rootCAcertificate.crt and execute the following command.<\/p>\n

gskcmd -cert -add -file <\/b>rootCAcertificate.crt<\/b> -db \/opt\/IHS\/SSL\/key.kdb -label primaryCA -pw WebAS -format ascii <\/b><\/p>\n

Step 7: Populate the certificates<\/b><\/h3>\n
gskcmd -cert -populate -db \/opt\/IHS\/SSL\/key.kdb -pw WebAS<\/b><\/div>\n
\u00a0<\/b><\/div>\n

Now <\/b>add the kdb path in the httpd.conf in ssl module tags and restart the apache server with -DSSL option.<\/p>\n

Basic commands of gskcmd to check the certificates:<\/b><\/p>\n

List the certificates : .\/gskcmd -cert -list -db \/opt\/IHS\/SSL\/key.kdb\u00a0<\/b><\/p>\n

Check the details of the certificates:\u00a0\u00a0<\/b><\/p>\n

.\/gskcmd -certreq -details -label labelname -db \/opt\/IHS\/SSL\/key.kdb<\/b>
\n.\/gskcmd -cert -details -label labelname -db \/opt\/IHS\/SSL\/key.kdb <\/b><\/p>\n

Delete a certificate : .\/gskcmd -cert -delete -label labelname -db \/opt\/IHS\/SSL\/key.kdb<\/b><\/p>\n

Extract a certificate : .\/gskcmd -cert -extract -db certificate.jks -label labelname -target test_myne.cer -type jks<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"

The following instructions will guide you to create csr and import the signed crt in the default kdb of IHS.<\/p>\n

Step 1: Finding the Kdb The default Kdb will be present in the IHS installation path. Find the key.kdb and take a back up before executing the commands. Step 2: Creation of Csr Use the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5669"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5669"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5669\/revisions"}],"predecessor-version":[{"id":5670,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5669\/revisions\/5670"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5669"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5669"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5669"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}