Creating a Keystore in ES

Follow the instructions below to create a new Keystore in WSO2 Enterprise Store (ES):

Step 1 - Create a Keystore

You can either create a new Keystore or use an existing Keystore. For more information, see the following WSO2 Carbon documentation.

Step 2 - Import the Keystore into the trust store

In SSL handshake, the client needs to verify the certificate presented by the server. For this purpose, the client usually stores the certificates it trusts, in a trust store. For more information, see Adding the public key to client-truststore.jks, which is in the WSO2 Carbon documentation.

Step 3 - Update the WSO2 Carbon configuration files

When configuring a Keystore, you need to update the WSO2 Carbon configuration related files (e.g., carbon.xml, catalina-server.xml etc.), which are common to all WSO2 products. For more information, see Configuring Keystores in WSO2 Products.

Step 4 - Update the WSO2 ES configuration files

When creating Keystores, you need to update specific WSO2 ES related configurations to authenticate the Publisher and the Store.

Update the publisher.json file, which is in the <ES_HOME>/repository/deployment/server/jaggeryapps/publisher/config directory.

You need to update this file in order to authenticate the Store successfully. You can not log into the Publisher if the following configurations are not carried out. The identityAlias should be the alias that you used when importing the PEM details of your key to the client-trustore.jks.

"authentication": {
        "activeMethod": "sso",
        "methods": {
            "sso": {
                "attributes": {
                    "issuer": "publisher",
                    "identityProviderURL": "%https.carbon.local.ip%/samlsso",
                    "responseSigningEnabled": "true",
                    "acs": "%https.host%/publisher/acs",
                    "identityAlias": "mynewcert",
                    "useTenantKey": false
                }
            },

Update the store.json file, which is in the <ES_HOME>/repository/deployment/server/jaggeryapps/store/config directory.

You need to update this file in order to authenticate the Publisher successfully. You can not log into the Store if the following configurations are not carried out. The identityAlias should be the alias that you used when importing the PEM details of your key to the client-trustore.jks.

    "authentication": {
        "activeMethod": "sso",
        "methods": {
            "sso": {
                "attributes": {
                    "issuer": "store",
                    "identityProviderURL": "%https.carbon.local.ip%/samlsso",
                    "responseSigningEnabled": "true",
                    "acs": "%https.host%/store/acs",
                    "identityAlias": "mynewcert",
                    "useTenantKey": false
                }
            },

Now, the Keystore is installed into WSO2 Enterprise Store.