Updating the server instance listener certificates

To change the SSL certificate for the server, update the keystore and truststore files with the new certificate.

The certificate file must have the new certificate in PEM-encoded format, such as:

If clients that already have a secure connection established with this server need to be maintained, information about both certificates can reside in the same file (each with their own begin and end headers and footers). If the listener certificate needs to be updated, it might be temporarily necessary for this property to have information about the old and new certificates. This can be done by including information about both certificates in the same file, each with their own begin and end headers and footers. Blank lines, and lines that start with the # character will be ignored.

After the keystore and truststore files are updated, run the following dsconfig command to update the server’s certificate in the topology registry:

The listener-certificate in the topology registry is like a trust store. The public certificates that it has are automatically trusted by the local server. When the local server attempts a secure LDAP connection to a peer, and the peer presents it with its certificate, the local server will check the listener-certificate property for that server in the topology registry. If the property contains the peer server’s certificate, the local server will trust the peer.