Delete SSL certificate from WCS WAS admin console

Once there was a requirement for me to delete an existing soon to expire SSL certificate from Websphere commerce server. I did with just delete option that we have for signer and personal certificate. But the problem occurred when stopping the server. The personal certificate reference was used in Dynamic end point configuration while it was deleted from key store, which gave error while stopping the server and the server did not start successfully and the test environment was all messed up:). Luckily I had a config backup, which I used it and the environment became all fine. But keep in mind before modifying anything in WAS admin console be sure to take config folder back up.  The config folder can be found in WCS installable folder as  for ex: C:\IBM\WebSphere\CommerceServer70\config

Steps to delete SSL certficate from WAS admin console in non clustered environment.

1) First delete the certificate reference from Dynamic endpoint configuration. 

SSL certificate and Management -> Dynamic outbound end point SSL configiguration -> Select the required NodeDefaultConfiguration entry and delete.  
2) Go to cellDefaultkeystore -> personal certificate -> Select the required certificate and choose replace--> select both option for delete in the next page -> then click apply.

3) Go to cellDefaultTruststore -> signer certificate -> If there is any signer certificate select it and delete.
4) Go to nodeDefaultTruststore -> signer certificate-> select the required signer certificate and delete.

5)  Go to nodeDefaultkeystore --personal certificate -> Select the required certificate and choose delete(need not replace here)
6) check all the 4 places (signer and personal - node and cell) in keystore and truststore the certificate entry should not be there.

7) In dynamic endpoint try creating new entry (don't save it) and c if the aliases dropdown should not contain the certificate name that you deleted. If it still contains the personal certificate name that you have deleted then it means it has not reflected in security.xml and certificate deletion is not done properly and you might get error while stopping server and face issues in the application.

In Non clustered environments it's more simpler:
1) First delete the certificate reference from Dynamic endpoint configuration. 
SSL certificate and Management -> Dynamic outbound end point SSL configiguration -> Select the required NodeDefaultConfiguration entry and delete. 

2) Go to nodeDefaultTruststore -> signer certificate-> select the required signer certificate and delete.

3)  Go to nodeDefaultkeystore --personal certificate -> Select the required certificate and choose replace--> select both option for delete in the next page -> then click apply.

 

Do not forget to delete the signer entry if found in nodeDefaultkeystore / cellDefaultkeystore.

SSL Certificate installation

SSL is a Self Signed certificate which is installed in the client machine and used when establishing a secured connection and exchanging data with the 3rd party vendor. In websphere commerce the SSL certificate is managed from WAS admin console.

In WAS admin console we have the options for :
1. Installing Singer certificate.
2. Install personal certificate.
3. Certificate expiry monitoring.
4. Delete/ Replace expired certificates.

Websphere commerce server environment can be either clustered (federated) / non clustered.  and N number of certificates can be installed in both of these server types.

We will see below steps on how to install SSL certificate through WAS admin console:   

But keep in mind before modifying anything in WAS admin console be sure to take config folder back up.  The config folder can be found in WCS installable folder as  for

ex: C:\IBM\WebSphere\CommerceServer70\config

Before beginning with Certificate installation in WAS admin console first we need to check that SSL Settings are configured properly.

1. Go to Security -> SSL Certificate and Key Management ->Manage end point security configurations 

2. Select the particular node / cell in outbound configurations based on the clustering.

3.      See to it that there is no certificate alias name selected in the Specific SSL configurations, it should be “none”: (Otherwise the alias selected certificate will only work in the server other certificates installed will not work)

4. Then go to Security -> SSL Certificate and Key Management -> SSL Configurations and select the NodeDefaultSSLSettings that was chose in step 3. 

5. In General Properties for NodeDefaultSSLSettings, see that ‘Default Server certificate alias’ and ‘Default client certificate alias’ is selected as “None” - (Otherwise the alias selected certificate will only work in the server, the other certificates will not work)

5.  Then the rest of the procedure is same that we follow for any SSL certificate installation: For ex:  

1. Cell Default trust store -> signer certificate ->retrieve from port number ->Give hostname and post number (default port number is 443) ->Save.   

2. NodeDefaulttrust store -> signer certificate -> retrieve from port number ->Give hostname and post number (default port number is 443) -> Save.

3. CelldefaultKeystore -> Personal certificate -> Import certificates -> Get Key file alias ->Give the path of the signer certificate from the serverGive the path of the signer certificate from the server Ex:  C:\Users\..\Desktop\certificateName.pfx Save.      Key file name -- Should be the file name including the path where it is placed.

4. Node default key store -> Personal certificate -> Import certificates -> Get key file alias -Ex:  C:\Users\..\Desktop\certificateName.pfx key file password - Password for the signer certificate Save     

5. SSL certificate and Management -> Dynamic outbound end point SSL config -> new -> NodeDefaultConfig
   https, https://... ,443 -> Add -> Save 

         Basically the entry should be in this form “https, hostname, 443” (443 is the default port)

Note : If you already have NodeDefaultConfig entry in your WAS server then you can use different name like NodeDefaultConfig1

Then restart the server.