How to use an Apache SSL certificate in JavaOften administrators want to use an SSL certificate they already bought for an Apache HTTPD in a Java server, such as Tomcat. This blog walks you through with step-by-step instructions on how to accomplish this goal.
The biggest challenge when using an SSL certificate from an Apache HTTPD server into any Java Server is to handle the different certificate type. Apache HTTPD uses OpenSSL to create a PKCS12 certificate, where as Java uses JKS. Although Java can be configured to use a PKCS12 certificate, a cleaner approach is to import a PKCS12 certificate and convert it into a JKS type.
MonologueBefore importing, I'd like to talk a little bit about public/private keys and certificates, which is very important to understand when dealing with this topic.
The first step in obtaining an SSL certificate is to create a public/private key pair. You use the
After creating the public/private key, you submit your public key in the form of a CSR to a certificate authority (CA) who signs your public key and sends you a certificate.
AssumptionsThis article assumes you have already created a public/private key and have received a certificate from a CA. You are already using this certificate on your Apache HTTPD server and now want to use the same certificate in a server written in Java, such as Tomcat.
Step-by-step instructionsStep 1 Gather necessary files
You will need the following files from your Apache Server.Step 2 Export the certificate
Using the following command export the existing certificateStep 3 Importing into a Java Keystore
openssl pkcs12 -export -in your.crt -inkey yourPrivate.key -out yourExportedCert.p12 -name any-name -CAfile gd_bundle.crt -caname rootNote: Type the above command in one line.
This command will prompt you for a password. As an example, use secret for this value, which will be used in the next step. The result of the above command will be a new file called
Now, let import this certificate into a Java Keystore using the following command.
keytool -importkeystore -deststorepass secret -destkeypass secret -destkeystore my.keystore -srckeystore yourExportedCert.p12 -srcstoretype PKCS12 -srcstorepass secret -alias any-nameNote: Type the above command in one line.
Now, your public/private keys as well as the certificate in JKS format. You can use this certificate in any server written in Java.