Federation Security Services Guide › Manage the Key Database for Signing and Encryption › Migrate AM.keystore and Update smkeydatabase

Migrate AM.keystore and Update smkeydatabase

Prior to SiteMinder 6.0 SP 5/6.x QMR 5, SiteMinder had the following PKI infrastructure:

• AM.keystore

  This store resided on the Web Agent at the consuming authority. The AM.keystore held Certificate Authority (CA) certificates and client certificates.

• smkeydatabase

  This store resided on the producing and consuming Policy Server systems. The certificates in this key database did not have corresponding aliases.

Beginning with SiteMinder 6.0 SP 5/6.x QMR 5, all data currently stored in the AM.keystore is now stored in the smkeydatabase at the consuming authority. Additionally, all certificates must have aliases.

If you are upgrading from versions prior to 6.0 SP 5/6.x QMR 5, you must do the following:

1. Copy private keys and certificates from the AM.keystore to the smkeydatabase on the consuming authority's Policy Server.
2. Migrate an existing smkeydatabase so aliases can be added to the certificates in the database.

The migratekeystore utility enables you to perform these tasks.

The following picture shows the changes in the PKI infrastructure.