Release 10.1A: OpenEdge Getting Started:
Installation and Configuration

> ## Installing trusted CA/root certificates

> To allow OpenEdge client access to an SSL server whose identity you need to have verified, you must install the appropriate root digital certificate to authenticate that server. An SSL server can have its identity established from one of two basic sources:

> - One of the trusted public CA root digital certificates distributed by Progress Software Corporation that includes RSA, Thawte, and Verisign.

> - A root digital certificate from an internal CA that you have set up on your own certificate server or from another external or public CA other than RSA, Thawte, or Verisign.

> OpenEdge automatically installs root certificates in the OpenEdge root certificate store from RSA, Thawte, and Verisign. However, if you use your own internal-use CA or a public CA other than these three, you must install the required root certificates yourself.

> OpenEdge provides the following command-line utilities to install and manage root certificates in the OpenEdge certificate store:

> - certutil — Installs, lists, and manages CA/root certificates from any CA as entries in the OpenEdge root certificate store and manages the certificate store for the client. You can also remove certificate store entries using this utility. The utility moves all removed entries to a `backup` subdirectory of the root certificate store for future recovery and use.

> Note: For .NET and Java Open Clients and Web service clients of OpenEdge application servers, you must use other utilities to manage the root certificate stores for those clients. For more information, see OpenEdge Development: Open Client Introduction and Programming .

> - mkhashfile — Provides simple installation of PEM-encoded root certificates into the OpenEdge root certificate store from any CA, but provides no other management functions for the OpenEdge certificate store. You can use `certutil` for the additional root certificate management.

> Notes: Before you run an OpenEdge command-line utility, set the `DLC` environment variable to the `OpenEdge_Installation` pathname and set the `WRKDIR` environment variable to your working directory. For an example, see the `OpenEdge_Installation/bin/``pkiutil` shell script on UNIX or the `OpenEdge_Installation\bin\``pkiutil.bat` file in Windows.
> Running the command-line utility in a `Proenv` command window properly sets `DLC` and `WRKDIR` for you.

Copyright © 2005 Progress Software Corporation www.progress.com Voice: (781) 280-4000 Fax: (781) 280-4095