Server Setup
WAS uses two protocols for client-server communication: CSIv2 and SAS:
CSI is used for v5.0 and higher, and provides support for SSL.
SAS is generally used for v4.0 and earlier, and does not support SSL.
There are five port numbers related to these two protocols; however, this does not matter to the client. You use the same URL (and the same port number) regardless of whether SSL is involved.
The one port that matters is called "CSI inbound transport" on the server. Set this port to "SSL supported" or "SSL required".
WebSphere installs with a default SSL “repertoire” already set up. The repertoire basically contains the details about the SSL configuration: where the keystore files are located, cipher suites in effect, keystore password. In WebSphere's administrative console you need to associate the CSIv2 protocol with this repertoire.
To use SSL, you must enable "global security" in WebSphere's administrative console. (In our testing we found that it was necessary to enable this feature.) The implication of this is that you have to now assign login credentials to access the server from anywhere, including its administrative console.
You can configure WAS to defer to an external authentication mechanism such as that imposed by the local operating system. Depending on your operating system, you may need to assign specific privileges to the process in which WebSphere runs in order to do this:
For Unix, WebSphere needs to run with root access.
For Windows, the user account from which WebSphere starts must be in the Administrators group and must have the "Act as part of the operating system" privilege enabled.