| From the administrative console, click Security >> Security Auditing >> Audit record signing configuration. |
Select the "Enable signing" checkbox.
Select the keystore that contains the encrypting certificate from the drop-down menu.
If you are using an existing certificate to sign your audit records, ensure the Certificate in keystore is selected and specify the intended certificate in the "Certificate alias" drop-down menu.
If you are generating a new certificate to sign your audit records, do NOT use the "Create a new certificate in the selected keystore" option, this will generate a SHA-1 signed certificate, which is not allowed.
Instead, select Security >> SSL Certificate and key management >> KeyStores and Certificates.
Select the keystore that is associated with the server hosting the audit logs.
Select "Personal Certificates".
Select either a CA-Signed or Chained Certificate based on your requirements.
Fill in the information required to generate the certificate.
Restart the DMGR and all the JVMs.