Requirements:
- You should be able to generate self signed SSL certificate and integrate it into Tomcat, as described in previous post.
You will learn:
- how to obtain and install a real SSL certificate from well known Certificate Authority (CA)
In the previous post I described the complete procedure of generating self signed SSL certificate and integrating it into Tomcat. In this post I would like to focus on the example with real certificate obtained from CA - I will use Thawte as example.
Note: let's assume that You created an application which is going to be visible under the following URL: http://www.myapp.com.
Step 1: generating self signed certificate for domain www.myapp.com.
This is exactly the same step to step 1 in previous post. You have to execute the following command:
keytool -genkey -alias myappcert -keyalg RSA -keystore myapp.keystore
Step 2: Generate Certificate Signing Request (CSR).
You have to generate a special request, which will be send to the CA. You have to execute command:
keytool -certreq -keyalg RSA -alias myappcert -file certreq.csr -keystore myapp.keystore
Generated request is saved as a certreq.csr file, which will be send to CA. CA will use this file to generate certificate signed by them.
Important: You have to use exactly the same alias (in this example: myappcert) for step 1 and step 2.
Step 3: Getting certificate from CA.
Usually certificate are delivered in PKCS#7 or X.509 format. For the first one, the file with certificate will have .p7b extension, for the second one - .cer. Sometimes You can get such certificate also by email as a pure text - for the X.509 format, certificate will be placed between tags -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----, for PKCS#7 certificate will be placed between tags -----BEGIN PKCS7----- and -----END PKCS7-----. Then You have to copy the certificate content (including those begin/end tags!) and save this as a .cer or .p7b file (You can use Notepad for that). Now You are ready to import Your signed certificate.
Step 4: importing signed certificate.
a) as a .p7b (PKCS#7) format:
Acording to the Thawte, when You obtained Your certificate as a .p7b file, You need only one command to import and install this certificate in Your keystore:
keytool -import -alias myappcert -trustcacerts -file signed_cert.p7b -keystore myapp.keystore
where signed_cert.p7b is a signed certificate obtained from CA.
b) as a .cer (X.509) format:
According to the Thawte, when You obtained Your certificate as .cer file, You need to download Primary and Secondary Intermediate CAs and import them. They are delivered as .p7b format (i.e. intermediate.p7b). I should import them first, using command:
keytool -import -trustcacerts -alias intermediatecerts -file intermediate.p7b -keystore myapp.keystore
and then import my certificate (it is in .cer file signed_cert.cer) using this command:
keytool -import -trustcacerts -alias myappcert -file signed_cert.cer -keystore myapp.keystore
where signed_cert.cer is a signed certificate obtained from CA.
Problem and workaround:
Both above ways seems to be simple, but... when I was buying some time ago a web SSL certificate from Thawte, I receive certificate as a pure text in e-mail. Certificate was in X.509 format (I had tags ----BEGIN/END CERTIFICATE-----). I created a signed_cert.cer file from that e-mail content. Then I tried to install intermediate certificates like it was described in Thawte documentation. Unfortunately it didn't work. The first command for importing intermediate certificates failed with error:
keytool error: java.lang.Exception: Input not an X.509 certificate
It seems that keytool does not work with .p7b format (I used JDK 1.6.0_16), so I expect that even if I get my certificate as .p7b file (complete, without need to import intermediate certificates as in a) subpoint) it will also not work. I took a .p7b file with intermediate certificates, opened it under Windows, and for each certificate found inside i exported it as a X.509 DER certificate, giving each file .cer extension. So I had three .cer (X.509) files: signed_cert.cer, thawte_primary.cer, thawte_secondary.cer. Now I had to import intermediate certificates and after that import my signed certificate with those commands:
keytool -import -trustcacerts -alias primary -file thawte_primary.cer -keystore myapp.keystore
keytool -import -trustcacerts -alias secondary -file thawte_secondary.cer.cer -keystore myapp.keystore
keytool -import -trustcacerts -alias myappcert -file signed_cert.cer -keystore myapp.keystore
Now import was OK. So the general workaround rule (if there are any troubles) is: get all needed certificates in X.509 form, import intermediate certificates (if any required) and import Your signed certificate at the end.
Important: You have to use exactly the same alias (in this example: myappcert) like You used in step 1 and step 2, except for importing intermediate certificates - You can use whatever alias You like.
Step 5: copy Your myapp.keystore file into Tomcat's /conf directory
Step 6: modify Tomcat configuration to use SSL certificate
It is exactly the same as step 3 in previous post.
That's all.
No comments:
Post a Comment