Page Comparison

After generating the key pair for server, the next step is to generate a key pair for the client.

1. Run the following command: 
   

   Code Block
   $ keytool -genkey -alias client -keyalg RSA -keystore ./Client.jks -storetype PKCS12

   alias = name of the key, for example, client 
keystore = name of the keystore, for example, Client.jks


   
   

   Note
   title Note!
   When prompted for first and last name the hostname where the certificate is valid should be entered, e.g. localhost. Other values can be anything.

   
   

   


2. Generate a Certificate Signing Request (CSR) so that we can get client's certificate signed by a CA.
   
   

   Code Block
   keytool -certreq -alias client -keystore Client.jks -file Client.csr

   
   

3. Get the certificate signed by our the CA, Test CA in these example. See 9.8182.2.4.1 41 Setting Up a Certificate Authority for instructions on how to set up a CA.
   
   

   Code Block
   $ openssl x509 -CA caroot.cer -CAkey cakey.pem -CAserial serial.txt -req -in Client.csr -out Client.cer -days 365

   
   

   Note
   title Note!
   CA, CAkey and CAserial are files generated when setting up the CA.

   
   

4. Import the Test CA root self signed certificate in client key store as a trusted certificate.
   

   Code Block
   $ keytool -import -alias TestCA -file caroot.cer -keystore Client.jks

   
   

5. Import client's certificate signed by Test CA in client key store with the same alias name that was used to generate the key pair during genkey.
   
   

   Code Block
   $ keytool -import -alias client -file Client.cer -keystore Client.jks

   
   
   

6. We also need to import server's public key in the client key store, because client is the first one who need to initiate a conversation with server or the service. And it needs to encrypt the request message (some part of it) using sever's public key. Server does not need client's public in its keystore if the Binary Security Token is used, server is going to get the client public key in the SOAP message itself.
   

   Code Block
   $ keytool -import -alias server -file Server.cer -keystore Client.jks

   
   

...