Creating a self-signed certificate
It usually takes two to three weeks to get a certificate from a well known certificate authority (CA). While waiting for a certificate to be issued, use IKEYMAN to create a self-signed server certificate to enable SSL sessions between clients and the server. Use this procedure if you act as your own CA for a private Web network. Complete the following steps to create a self-signed certificate:
1. If you have not created the key database, see Creating a new key database for instructions.
2. Start the IKEYMAN user interface.
3. Click Key Database File from the main UI, and then click Open.
4. Enter your key database name in the Open dialog box, or click the key.kdb file, if you use the default. Click OK.
5. In the Password Prompt dialog box, enter your correct password and click OK.
6. Click Personal Certificates in the Key Database content frame, and click the New Self-Signed radio button.
7. Enter the following information in the Password Prompt dialog box: v Key label: Enter a descriptive comment to identify the key and certificate in the database.
v Key size: Choose your level of encryptions from the drop-down menu.
v Common Name: Enter the fully qualified host name of the Web server as the common name. Example:
www.myserver.com.
v Organization Name: Enter your organization name.
v Optional: Organization Unit v Optional: Locality
v Optional: State/Province
v Optional: Zip code
v Country: Enter a country code. Specify at least two characters. Example: US Certificate request file name, or use the default name.
v Validity Period
8. Click OK.
其实在生产环境中应该是创建完key database后将CA发的证书（如*.cer）导入，自己做试验的话自签一个就可以了，并不影响配置和实现。
2、修改http.conf。
以下是我在http.conf中增加的：
# SSL config
LoadModule ibm_ssl_module modules/mod_ibm_ssl.so
<IfModule mod_ibm_ssl.c>
Listen 443
<VirtualHost *:443>
SSLEnable
</VirtualHost>
</IfModule>
SSLDisable
KeyFile "C:/IBM/HTTPServer/bin/mykey.kdb"
一开始看到IBM中国的论坛上说NT环境的话load一个XXX.dll，但是打开IHS_HOME\modules看到了一大堆的so，而且原来的http.conf中也load了不少so，找redbook上写的应该没错。改完保存重新启动IHS，一切OK。
下面开始验证，就拿snoop来试一试吧。打开
http://...:9080/snoop，显示正常。试试
http://.../snoop，等了半天没出来。troubleshooting的时间到了，很明显request没有被plugin转发给WAS，重新生成插件看看。在DM console中找到“环境--更新全局 Web 服务器插件配置”，更新完之后原来http.conf中的WebSpherePluginConfig指向的文件并没有更新，难道是插件位置不对？修改为DM_HOME\config\cells\plugin-cfg.xml，这回IHS读到新的插件了，但是老觉得“更新全局 Web 服务器插件配置”中的全局好像大对劲。搞了半天没找对地方，更新webserver1的插件应该是在“服务器--Web服务器”中的这回应该没错了，再试还是老样子。突然想起来之前做过的另一个试验给server1加上了80侦听，动手把IHS改成81。修改了Listen 0.0.0.0:81和ServerName szd610-286.boshi.com.cn:81两行。奇怪的是原来IHS占着80，server1启动时也不会报错。重起webserver1和server1后80和81都正常启动了，
http://...:81/snoop和
http://.../snoop访问正常，访问
https://.../snoop出来两个安全警报，确定后终于看到了snoop。
工具 
帮助
