Administering certificate authority clients using the wsadmin tool

Use this topic to modify certificate authority (CA) client objects. The client object contains all of the configuration information necessary to connect to your third-party CA server.

• View existing CA client objects and configuration data.
  Use the listCAClients and getCAClient commands to query your environment for your existing CA clients.
  1. Launch the wsadmin scripting tool using the Jython scripting language. See the Starting the wsadmin scripting client article for more information.
  2. List all CA client objects in your configuration.
     Use the listCAClients command to list all certificate authority clients in your configuration. If you do not provide a value for the -scopeName parameter, then the command queries the cell if you use a deployment manager profile or queries the node if you use an application server profile. Use the -all parameter to query your environment without using a specific scope, as the following example demonstrates:

     print AdminTask.listCAClients('-all true')

     The command returns an array of attribute lists, displaying one attribute list for each CA client, as the following example output displays:

     '[ [backupCAs ] [managementScope (cells/myCell01|security.xml#ManagementScope_1)
     ] [scopeName (cell):myCell01] [name jenCAClient] [baseDn ] [_Websphere_Config_Da
     ta_Id cells/myCell01|security.xml#CAClient_1181834566881] [port 2950] [CACertifi
     cate ] [pkiClientImplClass com.ibm.wsspi.ssl.WSPKIClient] [userId ] [_Webspher
     e_Config_Data_Type CAClient] [retryCheck 0] [properties ] [frequencyCheck 0] [pa
     ssword ] [host ] ]'
     '[ [backupCAs ] [managementScope (cells/myCell01|security.xml#ManagementScope_1)
     ] [scopeName (cell):myCell01] [name myCAClient] [baseDn ] [_Websphere_Config_Dat
     a_Id cells/myCell01|security.xml#CAClient_1181834566882] [port 2951] [CACertific
     ate ] [pkiClientImplClass com.ibm.wsspi.ssl.WSPKIClient] [userId ] [_Websphere
     _Config_Data_Type CAClient] [retryCheck 0] [properties ] [frequencyCheck 0] [pas
     sword ] [host ] ]'

  3. List the configuration attributes for a specific CA client.
     Use the getCAClient command to view the list of attributes for a specific CA client, as the following example demonstrates:

     print AdminTask.getCAClient('-caClientName myCAClient')

     The command returns an attribute list that contains the attribute and value pairs for the specific CA client, as the following example demonstrates:

     '[ [backupCAs ] [managementScope (cells/myCell01|security.xml#ManagementSc
     ope_1)] [scopeName (cell):myCell01] [name myCAClient] [baseDn ] [_Websphe
     re_Config_Data_Id cells/myCell01|security.xml#CAClient_1181834566882] [por
     t 2951] [CACertificate ] [pkiClientImplClass com.ibm.wsspi.ssl.WSPKIClient] [u
     serId ] [_Websphere_Config_Data_Type CAClient] [retryCheck 0] [properties ] [fre
     quencyCheck 0] [password ] [host ] ]'

• Modify your existing CA client object configuration data.
  Use the modifyCAClient command to change one or more configuration attributes for a specific CA client.
  1. Start the wsadmin scripting tool.
  2. Determine which configuration attributes to edit.
     The modifyCAClient modifies all attributes that you specify with the command parameters. If you do not specify a parameter, then its corresponding attribute does not change.

     Table 1. Command parameters . You can edit the following configuration data with the modifyCAClient command:

     Parameter	Description	Data Type
     -scopeName	Specify the management scope of the CA client. For a deployment manager profile, the system uses the cell scope as the default. For an application server profile, the system uses the node scope as the default.	String
     -pkiClientImplClass	Specify the class path that implements the WSPKIClient interface. The system uses this path to connect to the CA and to issue requests to the CA.	String
     -host	Specify the host name in your system where the CA resides.	String
     -port	Specify the port on the server where the CA listens.	String
     -userName	Specify the user name to use to authenticate to the CA.	String
     -password	Specify the password for the user name that authenticates to the CA.	String
     -frequencyCheck	Specify how often, in minutes, the system should check with the CA to determine if a certificate has been created.	String
     -retryCheck	Specify the number of times to check with the CA to determine if a certificate has been created.	String
     -customProperties	Specifies a comma separated list of attribute and value (attribute=value) custom property pairs to modify on the CA Client object. You can create, modify, or remove properties. To remove a property specify attribute= attribute as equal to no value.	String

  3. Modify specific configuration attributes for a CA client object.
     Use the following example command to modify the port number of the CA, the user name, and password attributes for the myCAClient CA client object:

     AdminTask.modifyCAClient('[-caClientName myCAClient -port 4060 -userName admin
      -password password4admin -pkiClientImplClass com.ibm.wsspi.ssl.WSPKIClient]')

  4. Save your configuration changes.
     Use the following command example to save your configuration changes:

     AdminConfig.save()

• Remove a CA client object from your configuration.
  Use the deleteCAClient command to delete a CA client object from your configuration. The command does not delete the CA client object if the CA client to delete is referenced by a certificate object.
  1. Start the wsadmin scripting tool.
  2. Determine the CA client object to delete.
     Use the listCAClients command to list all certificate authority clients in your configuration. If you do not provide a value for the -scopeName parameter, then the command queries the cell if you use a deployment manager profile or queries the node if you use an application server profile. Use the -all parameter to query your environment without using a specific scope, as the following example demonstrates:

     print AdminTask.listCAClients('-all true')

  3. Delete the CA client object of interest.
     Use the deleteCAClient command to delete the CA client object from your configuration. Use the -caClientName parameter to specify the CA client to delete. You can optionally specify the management scope of the CA client object with the scopeName parameter. The following example command removes the myCAClient CA client object:

     AdminTask.deleteCAClient('[-caClientName myCAClient]')

     If you receive an error message, then verify that the CA client object of interest exists in your configuration and that it is not referenced by a certificate object in your security configuration.
  4. Save your configuration changes.
     Use the following command example to save your configuration changes:

     AdminConfig.save()