Adding Keystores

You can add a keystore using either the management console or an XML file as explained below:

Adding Keystores using the Management Console

1. Log in to the product's management console and select the Keystores sub menu under the Configure menu.
   
   
2. The Keystore Management page opens. Click Add New Keystore.
   
   
3. In the page that opens, provide the following information:
   
   • Keystore File : The file where security certificates are stored in order to sign data to be transmitted.
     
   • Keystore Password : Give the same password required to access the private key.
     
   • Keystore Type : WSO2 supports two types of keystores as follows:
     
     • JKS (Java Keystore) : You can read and store key entries and certificate entries in this type. Key entries can store only private keys.
     • PKCS12 (Public Key Cryptography Standards) : You can read a keystore in this format and export the information from that keystore, but you cannot modify the keystore. This is used to import the certificates from different browsers into your Java keystore.
   For example,     
   
4. Click Next, provide Private Key Password in and Finish. 

Adding Keystores using an XML File

WSO2 products use several Keystores to power the HTTPS transport and encrypt other confidential information such as administrator passwords. The keystore of the HTTPS transport is configured in  <PRODUCT_HOME>/repository/conf/axis2/axis2.xml file under the HTTPS transport receiver and HTTPS transport sender configurations. For example,

<parameter name="keystore" locked="false">
	<KeyStore>
		<Location>resources/security/wso2carbon.jks</Location>
		<Type>JKS</Type>
		<Password>wso2carbon</Password>
		<KeyPassword>wso2carbon</KeyPassword>
	</KeyStore>
</parameter>
<parameter name="truststore" locked="false">
	<TrustStore>
		<Location>resources/security/client-truststore.jks</Location>
		<Type>JKS</Type>
		<Password>wso2carbon</Password>
	</TrustStore>
</parameter>

The default keystores are in <PRODUCT_HOME>/repository/resources/security directory. To change the keystores used by the HTTPS transport, update the HTTPS transport receiver and sender configurations by specifying the paths to the keystore files and other attributes such as the keystore passwords.

Provide the keystores used to encrypt administrator passwords and other confidential information in <PRODUCT_HOME>/repository/conf/carbon.xml file, under the <security> element. For example,

<KeyStore>
	<Location>${carbon.home}/resources/security/wso2carbon.jks</Location>
	<Type>JKS</Type>
	<Password>wso2carbon</Password>
	<KeyAlias>wso2carbon</KeyAlias>
	<KeyPassword>wso2carbon</KeyPassword>
</KeyStore>