Creating a certificate for the IBM Workload Scheduler agent

Perform the following steps to create certificates that are signed by a local common trusted CA on every IBM Workload Scheduler agent in your network.
  1. Enter the following command to create a default CMS key database client.kdbˮ with password “password02ˮ that expires after 1000 days. The password is also stored in stash file “client.sthˮ. 
    gsk7capicmd -keydb -create -db client.kdb -pw password02 
    -stash -expire 1000 -fips
  2. Enter the following command to add the CA certificate as trusted in the CMS key database. The label “CA certificate clientˮ is used to address that certificate. 
    gsk7capicmd -cert -add -db client.kdb -pw password02 
    -label "CA certificate client" -trust enable -file CA.crt 
    -format ascii -fips
  3. Enter the following command to create the client certificate request based on 2048 bits key, with label “Client WA95 Certificateˮ and distinguish name “CN=Client WA95,O=IBM,OU=TWS,C=ITˮ. The certificate request “client.csrˮ is generated and the private key is created in the key database client.kdb. 
    gsk7capicmd -certreq -create -db client.kdb -pw password02 
    -label "Client WA95 Certificate" -size 2048 -file client.csr 
    –dn "CN=Client  WA95,O=IBM,OU=TWS,C=IT" -fips
  4. Enter the following command so that the CA signs the client's certificate request and generates a new signed in file “client.crtˮ. 
    gsk7capicmd -cert -sign -db ca.kdb -pw password00 -label "CA certificate" 
     -target client.crt -expire 365 -file client.csr -fips
  5. Enter the following command to import the signed certificate “client.crtˮ in the CMS key database “client.kdbˮ. 
    gsk7capicmd -cert -receive -db client.kdb -pw password02 -file client.crt -fips
You can repeat these steps above for all agents or you can use the same certificate for all agents, depending on your security policies and IBM Workload Scheduler localopts configurations.