Use key tool utility (smkeytool) is only to resolve CDS migration issues. For all other certificate management, use the CA SiteMinder® Federation Standalone Administrative UI.
The key tool utility (smkeytool):
federation_install_dir/siteminder/bin
Specifies the installation path of the product.
Follow these steps:
This section contains the following topics:
Add a Private Key and Certificate Pair
Export a Certificate or Private Key
Import Default CA Certificates
List Metadata for all Certificates
Use the addPrivKey option to import only a private key/certificate pair into the certificate data store. Consider the following items:
Typically, the key is the first private key/certificate pair found in the certificate data store.
Arguments for this option include the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
Required. Assigns an alias to a private key/certificate pair in the database. The alias must be a unique string and can contain only alphanumeric characters.
Specifies the full path to the location of the certificate that is associated with the private key/certificate pair. Required for keys in PKCS1, PKCS5, and PKCS8 format.
Specifies the full path to the location of the private key file. Required for keys in PKCS1, PKCS5, and PKCS8 format.
Specifies the full path to the location of the PKCS12 file that contains the private key/certificate pair data. Required for keys in PKCS12 format.
(Optional) Specifies the password that was used to encrypt the private key/certificate pair when the pair was created. Supply this password to decrypt the key/certificate pair before it gets written to the certificate data store.
Note: This password is not stored in the certificate data store.
After the key/certificate pair is decrypted and placed in the certificate data store, CA SiteMinder® encrypts the pair again using its own password.
Use the addCert option to add a public certificate or trusted CA certificate to the certificate data store.
Consider the following items:
Arguments for this option include the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
Required. Specifies the alias to the certificate associated with the private key in the certificate data store.
Limit: A unique string that contains only alphanumeric characters.
Required. Specifies the full path to the location of the newly added certificate.
Optional. Checks that the user provider certificate being added is a CA certificate. The utility checks that the certificate has a digital signature extension and that the certificate has the same IssuerDN and Subject DN values.
(Optional) The user is not prompted to confirm the addition of the certificate.
Use the addRevocationInfo option to specify the location of a CRL. The certificate data store references the location of the CRL.
Arguments for this option include the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
Required. Specifies the alias of the Certificate Authority who issues the CRL.
Example: -issueralias verisignCA
Required. Specifies if the CRL is LDAP–based or file–based.
Required. Specifies the location of the CRL.
Example: -location c:\crls\siteminder_root_ca.crl
Example: -location "http://localhost:880/sn=siteminderroot, dc=crls,dc=com"
Use the deleteRevocationInfo option to delete a CRL from the certificate data store.
Arguments for this option include the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
(Required) Specifies the name of the Certificate Authority who issues the CRL.
(Optional) The user is not prompted to confirm that the CRL can be deleted.
Use the removeAllCertificateData option to remove all certificate data from the certificate data store.
The argument for this option is the following:
(Optional) The user is not prompted to confirm that the certificate data can be removed.
Use the delete option to remove a certificate from the certificate data store. If the certificate has an associated private key, the key is also deleted.
Arguments for this option include the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
(Required) Specifies the alias of the certificate that the option is to remove.
(Optional) The user is not prompted to confirm that the certificate can be removed.
Use the export option to export a certificate or private key to a file.
Consider the following items:
Arguments for this option include the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
(Required) Identifies the certificate or key to be exported.
(Required) Specifies the full path to the file to which the data is exported.
(Optional) Specifies whether a certificate or key is being exported.
Default: certificate.
Required only when exporting a private key. Specifies the password that is used to encrypt the private key when exported. You do not need a password to export the certificate holding the public key because certificates are exported in clear text.
To add this private key back to the certificate data store, use the addPrivKey option with this password.
Use the findAlias option to find the alias that is associated with a certificate in the certificate data store.
Arguments for this option include the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
(Required) Specifies the full path to the certificate file associated with the alias you want.
Required only when a password–protected P12 file is specified as the certificate file.
Use the importDefaultCACerts option to import all default trusted Certificate Authority certificates that are included with CA SiteMinder® to the certificate data store.
The argument for this option is the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
Use the listCerts option to list some metadata of all certificates stored in the certificate data store.
Arguments for this option include the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
(Optional) Lists the metadata details of the certificate and key that are associated with the alias specified.
This option supports an asterisk (*) as a wildcard character. Use the wildcard at the
Enclose the wildcard in quotes to prevent a command shell from interpreting the wildcard character.
Use the listRevocationInfo option to display a list of certificate revocation lists in the certificate data store. The following items are listed:
Arguments for this option include the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
(Optional) Name of the Certificate Authority who issues the CRL.
This option supports an asterisk (*) as a wildcard character. Use the wildcard at the:
Enclose the wildcard in quotes to prevent a command shell from interpreting the wildcard character.
Use the printCert option to display some metadata for a specified certificate. This command is useful on systems where viewing certificate properties is difficult.
Arguments for this option include the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
Required. Location of the certificate file.
The password is required only when a password-protected P12 file is specified as the certificate file.
Use the renameAlias option to rename an alias that is associated with a certificate.
Arguments for this option include the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
(Required) Specifies the alias that is associated with a certificate.
(Required) Specifies the new alias name.
Limits: Must be a unique string that contains only alphanumeric characters.
Use the validateCert option to determine if a certificate is revoked.
Arguments for this option include the following:
Specifies that the option applies to the legacy smkeydatabase. If you do not supply this argument, the option applies to the 12.52 SP1 certificate data store.
(Required) Specifies the alias to the certificate associated with the private key in the certificate data store
Limits: Must be a unique string that contains only alphanumeric characters.
(Optional) Specifies the CRL that you want the utility to look in for the certificate to validate it.
|
Copyright © 2014 CA.
All rights reserved.
|
|