[id='setting-up-credential-keystores_{context}']
= Setting up credential keystores

Create keystores that encrypt credential for {brandname} Server access.

A credential keystore contains at least one alias that is associated with an encrypted password.
After you create a keystore, you specify the alias in a connection configuration such as a database connection pool.
{brandname} Server then decrypts the password for that alias from the keystore when the service attempts authentication.

You can create as many credential keystores with as many aliases as required.

.Procedure

. Open a terminal in `{server_home}`.
. Create a keystore and add credentials to it with the [command]`credentials` command.
+
[TIP]
====
By default, keystores are of type PKCS12.
Run [command]`help credentials` for details on changing keystore defaults.
====
+
The following example shows how to create a keystore that contains an alias of "dbpassword" for the password "changeme".
When you create a keystore you also specify a password for the keystore with the `-p` argument.
+
Linux::
+
[source,options="nowrap",subs=attributes+]
----
include::cmd_examples/credentials_nix.adoc[]
----
+
Microsoft Windows::
+
[source,options="nowrap",subs=attributes+]
----
include::cmd_examples/credentials_win.adoc[]
----
+
. Check that the alias is added to the keystore.
+
[source,options="nowrap",subs=attributes+]
----
$ bin/cli.sh credentials ls -p "secret1234!"
dbpassword
----
+
. Configure {brandname} to use the credential keystore.
.. Specify the name and location of the credential keystore in the `credential-stores` configuration.
.. Provide the credential keystore and alias in the `credential-reference` configuration.
+
[TIP]
====
Attributes in the `credential-reference` configuration are optional.

* `store` is required only if you have multiple keystores.
* `alias` is required only if the keystore contains multiple aliases.
====
