Before you begin
This document describes how to configure trust anchors for the generator binding at the application level. It does not describe how to configure trust anchors at the server or cell level. Trust anchors defined at the application level have a higher precedence over trust anchors defined at the server or cell level. For more information on creating and configuring trust anchors on the server or cell level, see Configuring trust anchors on the server or cell level.
You can configure a trust anchor for the application-level trust anchor using an Application Server Toolkit or the administrative console. This document describes how to configure the application-level trust anchor using the administrative console.
Why and when to perform this task
A trust anchor specifies key stores that contain trusted root certificates, which validate the signer certificate. These key stores are used by the request generator and the response generator (when Web services is acting as client) to generate the signer certificate for the digital signature. The keystores are critical to the integrity of the digital signature validation. If they are tampered with, the result of the digital signature verification is doubtful and comprised. Therefore, it is recommended that you secure these keystores. The binding configuration specified for the request generator must match the binding configuration for the response generator.
The trust anchor configuration for the request generator on the client must match the configuration for the request consumer on the server. Also, the trust anchor configuration for the response generator on the server must match the configuration for the response consumer on the client.
Complete the following steps to configure trust anchors for the generator binding on the application level:
Steps for this task
Result
This task configures trust anchors for the generator binding at the application level.What to do next
You must specify a similar trust anchor configuration for the consumer.