{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40657,"path":"platform-security/authentication/t_CreatingAServiceProviderKeyStore.md","title":"Create a service provider key store for SAML","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create a service provider key store for SAML\n\nCreate a Java key store containing the following items for your instance to sign logout requests.\n\n## Before you begin\n\nRole required: sso\\_config\\_admin, business\\_rule\\_admin, script\\_include\\_admin\n\n## About this task\n\n-   Signed server certificate for the instance\n-   Signed CA certificate\n-   Public and private key pair\n\nYou may create your own signed certificate with a private certificate authority or purchase one from a public certificate authority.\n\nThe following steps illustrate how to generate a new Java Keytool keystore file, create a certificate signing request \\(CSR\\), and import certificates. Any root or intermediate certificates need to be imported before importing the primary certificate for your domain. Type these commands in a command line interface.\n\n**Note:** These instructions are not specific to the platform and require technical knowledge of security certificates to complete. Technical Support cannot assist in creating the certificates.\n\n## Procedure\n\n1.  Generate a Java keystore and key pair.\n\n    ```\n    keytool -genkey -alias mydomain -keyalg RSA -keystore my.keystore\n    ```\n\n2.  Generate a CSR for an existing Java keystore.\n\n    ```\n    keytool -certreq -alias mydomain -keystore my.keystore -file mydomain.csr\n    ```\n\n3.  Import a root or intermediate certificate authority CA certificate to an existing Java keystore.\n\n    ```\n    keytool -import -trustcacerts -alias root -file Thawte.crt -keystore my.keystore\n    ```\n\n4.  Import a signed primary certificate to an existing Java keystore.\n\n    ```\n    keytool -import -trustcacerts -alias mydomain -file mydomain.crt -keystore my.keystore\n    ```\n\n\n"}}