最好的情况是信任存储区包含全部自签名证书，或者除包含受信任CA的单一入口之外没有其他任何项。
In the best case, the trust store will consist entirely of self-signed certificates, or it will contain a single entry for a trusted ca and nothing else.
如果访问完全基于自签名证书，则从信任存储区中删除证书的公钥将撤销其访问权。
If access is based entirely on self-signed certificates, deleting the public key of a certificate from the trust store revokes its access.
当创建该数据库时，该信任存储区由商业证书颁发机构提供的一套缺省密钥填充。
When the database is created, the trust store is populated with a default set of keys from commercial certificate authorities.
使用除包含单个受信任存储CA之外没有其他任何内容的信任存储区，CRL提供一个等效的每DN撤销功能，撤销证书将有效撤销访问权。
With a trust store consisting of a single trusted ca and nothing more, the CRL approaches an equivalent per-DN revocation capability in which revocation of the certificate effectively revokes access.
如果在WebSphereApplicationServerND单元中启用了全局安全性，则将在缺省的 SSL指令表配置中设置缺省的密钥和信任存储区。
When global security is enabled in a WebSphere Application Server ND cell, the default key and trust stores are set in the default SSL repertoire configuration.
使用这些存储区可以读取和写入不太受信任的代码无法访问的数据，并可以防止公开保存在文件系统其他位置的敏感信息。
With these stores, you can read and write data that less trusted code cannot access and prevent the exposure of sensitive information that can be saved elsewhere on the file system.
信任存储区和密钥存储区的管理现在作为第一类构造进行处理。
The management of trust stores and key stores is now handled as a first class construct.
为了执行此操作，信任关系管理器将用于部署签名的证书与客户端受信任的发行者存储区中存储的证书进行比较。
The trust manager makes this choice by comparing the certificate used to sign the deployment with the certificates stored in the client's trusted publisher store.
密钥数据库中的另一部分是信任存储区，它包含由该队列管理器信任的数据的所有公钥。
Another section in the key database is the trust store and it contains all of the public keys of things that are trusted by the queue manager.
DMZ应该包括一些进程，例如，在用户连接到达后端“受信任”区之前，Web服务器或代理服务器将终止用户的连接。
The DMZ should consist of processes like Web servers or proxy servers that will terminate the user's connection before it reaches the backend "trusted" zone.
从信任存储区中删除所有未使用的证书颁发机构。
Delete all unused certificate authorities from the trust store.
将客户机证书导入到服务器信任存储区中。
信任存储区的作用相当于一个枚举允许连接的所有标识的列表。
The trust store effectively becomes an enumeration of all the identities allowed to connect.
但仍需要基本检查，这意味着证书签名者必须存在于信任存储区中。
There is still the basic check, meaning that the certificate signer must be present in the trust store.
接下来，检查签名CA的证书是否存在于本地信任存储区中。
Next, a check is made to see if a certificate for the signing ca exists in the local trust store.
自签名证书的信任存储区项与一个且仅与一个证书匹配。
The trust store entry for a self-signed certificate matches one and only one certificate.
继续讨论在单一通道上匹配多个证书，信任存储区中有多个CA的情况会更糟。
Continuing the discussion of matching multiple certificates on a single channel, the situation gets worse with multiple CAs in the trust store.
如果客户端或服务器的信任存储区中尚没有ca根证书，则导入该证书。
Import the ca root certificate, if it does not already exist in the trust store of the client or the server.
如果是自签名证书，则该证书本身的公钥必须存在于信任存储区中。
In the case of a self-signed certificate, it is the certificate's own public key that must exist in the trust store.
撤销访问权限和撤销证书在功能上相当；从信任存储区中删除证书可同时完成这两项任务。
Revoking access privileges and revoking a certificate are functionally equivalent; removing the certificate from the trust store accomplishes both tasks.
在一个通道需要允许多个证书的情况下，信任存储区、sslpeer值和CRL之间的交互变得非常重要。
The interaction between the trust store, the SSLPEER value and the CRL becomes very important in those cases where a channel needs to allow multiple certificates.
任何给定DN的潜在SSLPEER匹配项至少要与信任存储区中CA的数量一样多，如果将证书重新颁发计入在内数量会更大。
The set of potential SSLPEER matches for any given DN is at least as large as the number of CAs in the trust store, larger if certificate reissuance is taken into account.
如果希望使用缺省ssl设置，请将WebSphereApplicationServer的公用证书添加到缺省信任存储区，如图27中所示。
If you want to use default SSL Settings, add the public certificate of WebSphere Application Server to the default trust store as shown in Figure 27.
当WebSphereMQ被配置成JMS提供程序时，它将对应用服务器使用缺省的密钥和信任存储区。
When WebSphere MQ is configured as a JMS provider, it will use the default key and trust stores for the application server.
客户机支持在连接之前未曾访问的服务器时提示(像ssh一样)将证书添加到客户机信任存储区(如果需要，可以将其禁用)。
Clients support prompting (like SSH) for adding certificates to the client trust store when contacting a server not previously accessed (this can be disabled if desired).
如果信任存储区中包括一个证书颁发机构，则使用SSLPEER或出口(或同时使用二者)过滤出不需要的连接。
If the trust store contains a certificate authority, filter unwanted connections using SSLPEER or an exit, or both.
打开企业信任存储区期间出现了错误。
An error occurred during the opening of the Enterprise Trust store.
因此，您必须在您信任的证书存储区中具有服务器的SSL证书。
So, you must have server's SSL certificate inside your trusted store of certificates.
向所有客户端上的受信任的发行者存储区添加发行者。
Add the publisher to the trusted publishers store on all clients.
向所有客户端上的受信任的发行者存储区添加发行者。
Add the publisher to the trusted publishers store on all clients.
应用推荐