Creating a self-signed certificate

It usually takes two to three weeks to get a certificate from a well-known CA. While waiting for an issued certificate, use IKEYCMD to create a self-signed server certificate to enable TLS sessions between clients and the server. Use this procedure if you are acting as your own CA for a private Web network.

For Windows platforms, for example, to create a self-signed certificate, enter the following command:

java com.ibm.gsk.ikeyman.ikeycmd -cert -create

-db your_install_directory\bin\HODServerKeyDb.kdb

-pw <password> -size <1024 | 512> -dn <distinguished name>

-label <label> -default_cert <yes or no>

where your_install_directory is your Host On-Demand installation directory.

Note the following descriptions:

-size: Key size 512 or 1024
-label: Enter a descriptive comment used to identify the key and certificate in the database.
-dn: Enter an X.500 distinguished name. This is input as a quoted string of the following format (Only CN, O, and C are required; CN=common_name, O=organization, OU=organization_unit,L=location, ST=state, province, C=country).
```
"CN=weblinux.raleigh.ibm.com,O=ibm,OU=IBM HTTP Server,L=RTP,ST=NC,C=US"
```
-default_cert: Enter yes, if you want this certificate to be the default certificate in the key database. If not, enter No.