Tivoli Integrated Portal. How-to install custom SSL certificat

​

1. You need:
• server certificate + intermidiate certificate + root certificate + private key in PFX file
• to convert certificate files from Windows CR+LF to Linux LF do this:
• copy files in Windows CR+LF format to Linux server
• run this command for each file:
  sed 's/$'"/`echo \\\r`/" input.txt > output.txt
• intermidiate certificate in Base64 Encoded PEM file. New line format should be Linux (LF).
• root certificate in Base64 Encoded PEM file. New line format should be Linux (LF).
• copy these 3 files to temporary directory on the TIP server. For example:
  /tmp/ssl/serverssl.pfx
  /tmp/ssl/GeoTrust_Root.pem
  /tmp/ssl/RapidSSL_Interm.pem
2. Open and login to Tivoli Integrated Portal. Usually this is URL https://<server_name>:16311/ibm/console/logon.jsp
3. In the left menu open Settings -> WebSphere Administrative Console and click Launch WebSphere Administrative Console
4. In the left menu open Security -> SSL certificate and key management. In the Related Items list, click Key stores and certificates.
5. Click NodeDefaultKeyStore. In the Additional Properties list, click Personal certificates and click Import...
6. Select Key store file. Enter full path to PFX file. For example: /tmp/ssl/serverssl.pfx. Enter password for PFX file and click Get Key File Aliases.
7. Select the certificate alias to import and assign a new alias name to the imported certificate (for example: rapidssl_2014-2016).
8. Click OK.
9. Click Save to save the changes to the WebSphere Application Server master configuration.
10. Click SSL certificate and key management -> Key stores and certificates -> NodeDefaultKeyStore -> Personal certificates.
11. Select certificate with alias default and Delete him.
12. Click Save to save the changes to the WebSphere Application Server master configuration.
13. Click SSL certificate and key management -> Key stores and certificates -> NodeDefaultTrustStore -> Signer certificates.
14. Click Add.
15. Specify the alias name for the new root CA signer certificate (for example: GeoTrust_Root), the certificate file name (for example: /tmp/ssl/GeoTrust_Root.pem), certificate data type (for example: Base64-encoded ASCII data), and click OK.
16. Click Save to save the changes to the WebSphere Application Server master configuration.
17. Repeat steps 13 to 15 to import all associated intermediary signer certificates (for example: to import RapidSSL intermidate SSL certificate).
18. Click SSL certificate and key management -> Key stores and certificates -> NodeDefaultTrustStore -> Personal certificates.
19. Click Import... (if do not have any SSL certificate in Personal certificates) or select the check box associated with the old SSL certificate and click Replace...
    In our example we will be Import new SSL certificate. So click Import...
20. Select Key store file. Enter full path to PFX file. For example: /tmp/ssl/serverssl.pfx. Enter password for PFX file and click Get Key File Aliases.
21. Select the certificate alias to import and assign a new alias name to the imported certificate (for example: rapidssl_2014-2016).
22. Enter once again password for PFX file and Click OK.
23. Click Save to save the changes to the WebSphere Application Server master configuration.
24. Refresh web page and check that new SSL certificate installed correctly to Integrated Solution Console.
25. Open Tivoli Integrated Portal and also check that new SSL certificate installed correctly.

PS.
This link was really helpfull Replacing existing WebSphere Application Server SSL certificates