If your goal is to modify the web server certificate that a user sees when connecting to the Identity Governance & Lifecycle web console, you will need to edit the keystore called aveksa.keystore. After modification, this keystore should contain the web server's private key, its associated signed certificate, and all CA certificates up to the root CA.
 

The following commands assume you will be creating a new keystore file called my.keystore which will later be used to replace the existing aveksa.keystore. The example below utilizes a server hostname of rsa-img.rsa.com, and can be accessed using a hostname alias access.rsa.com or IP 1.1.1.1, as well.

1. Go to the default keystore and truststore location for your version:

• For versions 6.8.x and 6.9.x

• For version 7.0.x

2. Create a new keystore file and new RSA 2048-bit keypair, using the password Av3k5a15num83r0n3 when prompted.  This example creates a certificate valid for the URLs using rsa-img.rsa.com, rsa-img, access.rsa.com, and 1.1.1.1.  If you are using Java 6, then the -ext will report an Illegal option -ext error, so please see the Notes section below for the work-around.  (The alias name must be "server".  See the Notes section.)

3. Generate a certificate request (PKCS#10) from that keypair, use the password Av3k5a15num83r0n3 when prompted:

4. Submit the certificate request (rsa-img.rsa.com.csr) to your CA for signing.  The steps below assume the following:

• cert.pem is the newly signed certificate generated from the certificate request
• sub.pem is the issuing CA of the certificate.
• root.pem is the root CA that signed the issuing CA sub.pem

5. Import the root CA in the default truststore (cacerts) as a trusted CA component (The default password is changeit):

6. Import the issuing CA in the default truststore (cacerts) as a trusted CA component (The default password is changeit):

7. Import the root CA into the keystore as a trusted CA component.  Enter "yes" when prompted, because the root certificate is already in the cacerts file, but is also needed in the keystore we are building:

8. Import the issuing CA in the keystore as a trusted CA component:

9. Import the certificate in the keystore:

10. You can review the keystore entries with the following command:

11. Make a copy of your current keystore file should you need to revert the changes:

12. Make sure the file permissions, and ownership of the new my.keystore match that of aveksa.keystore:

13. Replace aveksa.keystore with my.keystore and restart the services: