WSO2 AS uses several keystores to power the HTTPS transport and to encrypt other confidential information such as administrator passwords. The keystores used to encrypt administrator passwords and other confidential information in Carbon is configured in the <PRODUCT_HOME>/repository/conf/carbon.xml
file (under the <security
> element). Two keystore elements elements can be used to configure keystones in the carbon.xml
file can be used to configure the keystore: Primary keystore (Keystore
) and Registry Keystore (RegistryKeystore
).
Info |
---|
The default keystore named |
Note |
---|
Note that when keystones are configured, two keystore passwords are specified in the relevant .xml file:
|
Table of Contents | ||||
---|---|---|---|---|
|
...
The KeyStore
element configured in the carbon.xml
file can be considered as the default Carbon keystore elementconfiguration. This is used for the primary keystore, which mainly stores the keys certifying SSL connections to Carbon servers, and for encrypting administrator passwords as well as other confidential information. The keystore configuration in the carbon.xml
file is as given below. Note that in this example, we are using the default key store in the product pack (wso2carbon.jks).
...
RegistryKeyStore
is a separate keystore element configurable in the carbon.xml
file. Using . This configuration applies for the keystore which stores the keys that certify encrypting/decrypting meta data to the registry. Therefore, using this RegistryKeystore
element in addition to the Keystore
element in the carbon.xml
file allows file allows you to maintain a separate keystore with a different certification for the purpose of encrypting/decrypting meta data to the registry. The registry keystore configuration in the carbon.xml
file is as given below. Note that in this example, we are using referring to the default key store keystore in the product pack (wso2carbon.jks) as the registry keystore.
Code Block |
---|
<RegistryKeyStore> <!-- Keystore file location--> <Location>${carbon.home}/repository/resources/security/wso2carbon.jks</Location> <!-- Keystore type (JKS/PKCS12 etc.)--> <Type>JKS</Type> <!-- Keystore password--> <Password>wso2carbon</Password> <!-- Private Key alias--> <KeyAlias>wso2carbon</KeyAlias> <!-- Private Key password--> <KeyPassword>wso2carbon</KeyPassword> </RegistryKeyStore> |
...
The keystore of the HTTPS transport is configured in the axis2.xml
file under the HTTPS transport receiver and HTTPS transport sender configurations.
...
The default keystore named wso2carbon.jks
, can be found in the <PRODUCT_HOME>/repository/resources/security
directory. To change the keystores used by the HTTPS transport, update the HTTPS transport receiver and sender configurations by specifying the paths to keystores files and other attributes of the files such as the keystores passwords.
Info |
---|
Under the < |
The <Password
> element should indicate the password of the keystore file.
The <KeyPassword
> element should point to the password required to access the private key.