[id='setting-up-credential-keystores_{context}']
= Setting up credential keystores

Create keystores that encrypt credential for {brandname} Server access.

A credential keystore contains at least one alias that is associated with an encrypted password.
After you create a keystore, you specify the alias in a connection configuration such as a database connection pool.
{brandname} Server then decrypts the password for that alias from the keystore when the service attempts authentication.

You can create as many credential keystores with as many aliases as required.

[NOTE]
====
As a security best practice, keystores should be readable only by the user who runs the process for {brandname} Server.
====

.Procedure

. Open a terminal in `{server_home}`.
. Create a keystore and add credentials to it with the [command]`credentials` command.
+
[TIP]
====
By default, keystores are of type PKCS12.
Run [command]`help credentials` for details on changing keystore defaults.
====
+
The following example shows how to create a keystore that contains an alias of "dbpassword" for the password "changeme".
When you create a keystore you also specify a password to access the keystore with the `-p` argument.
+
Linux::
+
[source,options="nowrap",subs=attributes+]
----
include::cmd_examples/credentials_nix.adoc[]
----
+
Microsoft Windows::
+
[source,options="nowrap",subs=attributes+]
----
include::cmd_examples/credentials_win.adoc[]
----

. Check that the alias is added to the keystore.
+
[source,options="nowrap",subs=attributes+]
----
bin/cli.sh credentials ls -p "secret1234!"
dbpassword
----

. Open your {brandname} Server configuration for editing.
. Configure {brandname} to use the credential keystore.
.. Add a `credential-stores` section to the `security` configuration.
.. Specify the name and location of the credential keystore.
.. Specify the password to access the credential keystore with the `clear-text-credential` configuration.
+
[NOTE]
====
Instead of adding a clear-text password for the credential keystore to your {brandname} Server configuration you can use an external command or masked password for additional security.

You can also use a password in one credential store as the master password for another credential store.
====

. Reference the credential keystore in configuration that {brandname} Server uses to connect with an external system such as a datasource or LDAP server.
.. Add a `credential-reference` section.
.. Specify the name of the credential keystore with the `store` attribute.
.. Specify the password alias with the `alias` attribute.
+
[TIP]
====
Attributes in the `credential-reference` configuration are optional.

* `store` is required only if you have multiple keystores.
* `alias` is required only if the keystore contains multiple password aliases.
====

. Save the changes to your configuration.
