When using a Java server such as TomCat, most administrators will want to use a SSL certificate they have already purchased for Apache HTTPD.
Our goal is to walk you through the instructions of converting an SSL certificate to a Java certificate.
The biggest challenge when using an SSL certificate for an Apache HTTPD server in any Java Server is understanding the different certification types.
Apache HTTPD uses OpenSSL to create a PKCS12 certificate. Whereas Java uses JKS. Although Java can be configured to use a PKCS12 certificate, a cleaner approach is to import a PKCS12 certificate and convert it to a JKS type.
Before importing the PKCS12 certificate, I'd like to talk a little bit about public and private key certificates.
The first step in obtaining an SSL certificate is to create a public and private key pair. Use the openssl program to create this key pair when working with Apache HTTPD. When working with Java JDK, use the keytool program, which comes with JDK and is located in the
After creating the public and private key, submit your public key in the form of a CSR to a Certificate Authority (CA) who will sign your public key. Once they have signed your public key, the will send you a certificate.
.keyextension and should be in the same location where your certificate is located on the machine, which is typically set to
/etc/httpd/folder. I use the word should because often administrators change the file extension as well as the location of the files. I such cases you will have to contact the person who initially created the certificate.
.crtextension. It contains your public key that is signed by a CA and has other properties like the expiration date and validity.
openssl pkcs12 -export -in your.crt -inkey yourPrivate.key -out yourExportedCert.p12 -name any-name -CAfile gd_bundle.crt -caname rootNote: Type the above command in one line.
keytool -importkeystore -deststorepass secret -destkeypass secret -destkeystore my.keystore -srckeystore yourExportedCert.p12 -srcstoretype PKCS12 -srcstorepass secret -alias any-nameNote: Type the above command in one line.
|Created on:||Aug 2, 2013|
|Last updated on:||Jun 13, 2021|