A keystore is a repository that stores cryptographic keys and certificates. You use these artifacts for security purposes such as encrypting sensitive information, and establishing trust between your server and the outside parties that connect to it. See the following topics for details on keystores.childrenhow keystores are used in WSO2 products and the default keystore settings with which all products are shipped:
| Table of Contents | ||
|---|---|---|
|
The usage of keys and certificates contained in a keystore are explained below.
...
| Info | ||
|---|---|---|
| ||
The key pair and the CA-signed certificates in a keystore establishes two security functions in your server: The key pair with the digital certificate is an indication of identity and the CA-signed certificate provides trust to the identity. Since the public key is used to encrypt information, the keystore containing the corresponding private key should always be protected, as it can decrypt the sensitive information. Furthermore, the privacy of the private key is important as it represents its own identity and protects the integrity of data. However, the CA-signed digital certificates should be accessible to outside parties that require to decrypt and use the information. To facilitate this requirement, the certificates must be copied to a separate keystore (called a Truststore), which can then be shared with outside parties. Therefore, in a typical setup, you will have one keystore for identity (containing the private key) that is protected, and a separate keystore for trust (containing CA certificates) that is shared with outside parties. |
See the following topics for details on how keystores are used in WSO2 products and the default keystore settings with which all products are shipped:
| Table of Contents | ||
|---|---|---|
|
Setting up keystores for WSO2 products
...
- Maintain a primary keystore for encrypting sensitive data such as admin passwords and certain registry data. By default, the primary keystore is also used for WS-Security and for authenticating Tomcat level connections.
- Maintain a separate keystore for authenticating the communication over SSL/TLS for Tomcat level connections.
- Optionally, you can set up separate keystores with key pairs and certificates for WS-Security.
- A separate keystore (truststore) for the purpose of storing the trusted certificates of public keys in your keystores.
For information on creating new keystores with the required certificates, see the related linkson how to create new keystore files, see Creating New Keystores, and for information on how to update configuration files in your product with keystore information, see Configuring Keystores in WSO2 Products.
Default keystore settings in WSO2 products
...
| Info |
|---|
Note the following regarding WSO2 keystore management:
|
...
|