Federation Security Services Guide › Manage the Key Database for Signing and Encryption › Modify the Key Database Using smkeytool › Smkeytool Examples for UNIX Platforms

Smkeytool Examples for UNIX Platforms

Example: Create a key database

This example shows the command for creating an smkeydatabase:

smkeytool.sh -createDB -password siteminderdb

Example: Add a private key and certificate

This example shows the command to add a private key and certificate to the smkeydatabase. The example assumes you are running the smkeytool from the directory where the certificates and keys are located, as follows:

smkeytool.sh -addPrivkey -password keypswd -alias idp1privkey -keyfile privkey.pkcs8 -certfile sample.crt

If you are not running smkeytool from the directory where the certificates and keys are located, you need to specify the full path to directory where these items are located, as follows:

smkeytool.sh -addPrivkey -alias privkey1 -keyfile "export/ca/siteminder/certs/
sampleprivkey.pkcs8" -certfile "export/ca/siteminder/certs/samplecert.crt"

Example: Add an trusted CA certificate

This example shows the commands required to add a trusted certificate authority certificate:

Important! Before adding a trusted certificate, obtain a CA certificate from a certificate authority.

To add a trusted CA certificate:

1. Check whether it already exists in the consuming authority database by entering:

   smkeytool.sh -listCerts
   

2. Add the CA certificate by entering:

   smkeytool.sh -addCert -alias -sp1cacert -infile /opt/netegrity/siteminder/certs/sampleCARoot.cer -trustcacert
   

3. (Optional) Restart the Policy Server to see the change to the key database immediately.

   If you do not restart the Policy Server, it takes some time before the Policy Server and key database synchronize. The amount of time for key database to update automatically depends on the configured frequency of database updates. You can configure database updates by adjusting the DBUpdateFrequencyMinutes parameter in the smkeydatabase.properties file.