Federation Security Services Guide › Signing and Encrypting Messages to Secure Federated Transactions › Modify the Key Database Using smkeytool › Smkeytool Examples for Windows Platforms

Smkeytool Examples for Windows Platforms

The following are examples of using smkeytool to manage the smkeydatabase.

Example: Create a key database

This example shows the command for creating an smkeydatabase:

smkeytool.bat -createDB -password smdb

Example: Add a private key/certificate pair

The following example adds a private key/certificate pair to the smkeydatabase. The syntax is the same regardless of whether the key/certificate pair is used for signing and verification or encryption and decryption.

If you run smkeytool from the directory containing the private key/certificate pair, do not specify a directory path in the command line. The command syntax is as follows:

smkeytool.bat -addPrivkey -password keypswd  -alias privkey1
-keyfile sampleprivkey.pkcs8" -certfile samplecert.crt"

If you run smkeytool from a directory that does not contain the private key/certificate pair, specify the full path to the directory with the pair. The command syntax is as follows:

smkeytool.bat -addPrivkey -password keypswd -alias privkey1 -keyfile "c:\program 
files\ca\siteminder\certs\sampleprivkey.pkcs8"
-certfile "c:\program files\ca\siteminder\certs\samplecert.crt"

Example: Add a standalone certificate

The following example adds only a certificate to the smkeydatabase. This certificate can be associated with a private key/certificate pair, but this command only adds the certificate.

If you run the smkeytool from the directory containing the certificate, do not specify a directory path in the command line. The command syntax is as follows:

smkeytool.sh -addCert -password keypswd -alias sp2cert -certfile samplefile.crt

If you run smkeytool from a directory that does not contain the certificate, specify the full path to directory with the certificate. The command syntax is as follows:

smkeytool.sh -addCert -alias sp2cert -certfile "export/ca/siteminder/certs/samplefile.crt"

Example: Add a trusted CA certificate

The following example shows the commands required to add a trusted Certificate Authority (CA) certificate. For federated communication, SiteMinder can use a trusted CA for securing the back channel for HTTP-Artifact single sign-on.

Important! Obtain a CA certificate from a certificate authority before adding a trusted certificate.

To add a trusted CA certificate

1. Verify whether the certificate exists in the relying party database by entering:

   smkeytool.sh -listCerts
   

2. Add the CA certificate by entering:

   smkeytool.bat -addCert "c:\program files\ca\siteminder\certs\sampleCARoot.crt" -trustcacert
   

3. (Optional) Restart the Policy Server to see the change to the key database immediately.

   If you do not restart the Policy Server, it takes some time before the Policy Server and database synchronize. SiteMinder updates the key database based on the value of the DBUpdateFrequencyMinutes parameter in the smkeydatabase.properties file. You can adjust the frequency by modifying this parameter.