Configuring two-way SSL authentication for inbound traffic

You can configure two-way SSL authentication for inbound traffic to the WebSphere Application Server (WAS).

When two-way SSL authentication is configured, external systems can initiate calls to WAS. Then, WAS completes the SSL handshake and authentication. If a web server is deployed, traffic passes anonymously to the WAS server, which then completes the SSL handshake and authentication.

To enable two-way SSL authentication, you must:

Import the public certificate of the external system to the WAS trust store.
Import the client certificate for WAS into the WAS keystore. This client certificate may already exist or it must be provisioned by a Certificate Authority.
Generate and add a Base-64 encoded copy of the public certificate to the HTTPConnection parameter in the environment file.
Create a new user in the WebSphere user account repository (in Active Directory (AD), Lightweight Directory Access Protocol (LDAP), or the internal file repository) using the user name from the public certificate for the external system.

Before configuring two-way SSL for the application server, ensure that you have the following certificates.


Certificate	Description
client.cer	The public certificate for the external system.
client.pfx	The PKCS#12 keystore for the external system.
server.cer	The public certificate for the WAS.
server.pfx	The PKCS#12 keystore for the WAS.

You must also generate a Base-64 encoded copy of the client.cer certificate.

To configure two-way SSL for WAS:

On the WebSphere Application Server host machine, back up all WebSphere profiles.
Restart all WebSphere processes.
In WebSphere, import the following certificates:
1. Import the client.cer certificate into the CellDefaultTrustStore.
1. Import the server.pfx certificate into the CellDefaultKeyStore.

In NexJ Studio, in the environment file, copy the Base-64 encoded client.cer certificate into the Trust field for the inbound HTTPConnection channel. When you copy the certificate, ensure that you preserve newline characters for the certificate, as shown in the following example:

Note: The first line of the certificate must contain only -----BEGIN CERTIFICATE-----, and the last line must contain only -----END CERTIFICATE-----.

In the WebSphere user account repository, create a new user whose user name matches the first CN value of the subject field in client.cer certificate.
For example, to configure the user name for the following certificate, use production.company.com as the user name.
```
CN = production.company.com
CN = Services Department
O = Company Inc.
L = Toronto
S = Ontario
C = CA
```
If the WebSphere user account repository is configured for Active Directory or LDAP, create the user in Active Directory or LDAP. If the user account repository is configured for an internal file repository, create the user using the Integrated Solutions Console.
Important: If you create the new user in LDAP, you must enter the user name that you used for the WebSphere user account repository in the Full Name attribute. Do not enter values for the First Name and Last Name attributes.
If your WebSphere configuration uses a LDAP user account repository, you must update the certificate mapping for repository:
1. Launch the Integrated Solutions Console.
2. Click the Security field, then click Global security.
3. In User account repository, click Configure.
4. In Related Items, click Manage repositories.
5. Select the repository that represents the LDAP user account repository.
6. In the Certificate mapping field, select CERTIFICATE_FILTER.
7. Set the Certificate filter to cn=${SubjectCN}.
Restart all WebSphere processes.
Reconfigure and redeploy the application.
Verify the changes.

Two-way SSL authentication is configured for inbound traffic to the WAS.