Difference between revisions of "Managing SSL Certificates"
imported>Aeric m (Text replace - '{platform_installation}' to '{install_dir}') |
imported>Aeric |
||
| Line 9: | Line 9: | ||
'''To create a Certificate Signing Request (CSR)''' | '''To create a Certificate Signing Request (CSR)''' | ||
#Create a keystore | #Create a keystore and a private key: | ||
#:<tt>{install_dir}/tomcat/conf/RN</tt> | #:<tt>cd {install_dir}/tomcat/conf/RN</tt> | ||
#:<pre>keytool -genkey -alias tomcat -keyalg RSA -keystore | #:<pre>keytool -genkey -alias tomcat -keyalg RSA -keystore {keystore_filename}</pre> | ||
#Create a CSR from the keystore | #Create a CSR from the keystore | ||
#:<pre>keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore | #:<pre>keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore {keystore_filename}</pre> | ||
#The result is a file: <tt>certreq.csr</tt>, which can be submitted to the CA | #The result is a file: <tt>certreq.csr</tt>, which can be submitted to the CA | ||
| Line 25: | Line 25: | ||
#Install/import the chain certificate: Copy the contents of the chain certificate into a file called <tt>chain</tt> | #Install/import the chain certificate: Copy the contents of the chain certificate into a file called <tt>chain</tt> | ||
#Import the chain certificate into your keystore: | #Import the chain certificate into your keystore: | ||
#:<pre>keytool -import -alias root -keystore | #:<pre>keytool -import -alias root -keystore {keystore_filename} -trustcacerts -file chain</pre> | ||
#Import the certificate received from the CA: | #Import the certificate received from the CA: | ||
#:<pre>keytool -import -alias tomcat -keystore | #:<pre>keytool -import -alias tomcat -keystore {keystore_filename} -trustcacerts -file <certificate filename ></pre> | ||
====Replacing the Default SSL Certificate==== | ====Replacing the Default SSL Certificate==== | ||
Revision as of 22:41, 23 June 2011
Managing SSL Certificates
Obtaining an SSL Certificate
The platform provides a default self-signed certificate which is used by the Application Server.
To obtain and install your own SSL Certificate, make a request to a Certificate Authority (CA). An SSL certificate authenticates a website to a web browser, part of a security protocol to manage secure data exchange.
The CA will accept your Certificate Signing Request and generate a certificate which identifies your website as a secured website.
To create a Certificate Signing Request (CSR)
- Create a keystore and a private key:
- cd {install_dir}/tomcat/conf/RN
keytool -genkey -alias tomcat -keyalg RSA -keystore {keystore_filename}
- Create a CSR from the keystore
keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore {keystore_filename}
- The result is a file: certreq.csr, which can be submitted to the CA
Once you have obtained a certificate from the CA, in addition to your certificate, the CA might provide an Chain/Root Certificate, which must be installed/imported into the keystore created in the previous section.
To Install the Certificate
- If you have received the chain certificate from the (CA), complete #1 - #3:
- If you have NOT received the chain certificate from the (CA), complete #3 only:
- Install/import the chain certificate: Copy the contents of the chain certificate into a file called chain
- Import the chain certificate into your keystore:
keytool -import -alias root -keystore {keystore_filename} -trustcacerts -file chain
- Import the certificate received from the CA:
keytool -import -alias tomcat -keystore {keystore_filename} -trustcacerts -file <certificate filename >
Replacing the Default SSL Certificate
To replace the certificate:
- Add the new certificate to this directory:
- {install_dir}/tomcat/conf/RN
- Edit {install_dir}/tomcat/conf/server.xml file
- Replace the following line:
- keystoreFile="conf/RN/thirdParty" keystorePass="algrsa"
- with:
- keystoreFile="conf/RN/your_certficate_file_name"
- keystorePass="your_password_for_certificate_store"
- keystoreFile="conf/RN/thirdParty" keystorePass="algrsa"
- Save the file
- Restart the application server
The Application Server will now use your certificate file for communication over https.
Learn More
- Certificate Signing Request (CSR) Generation Instructions-Tomcat, at
https://knowledge.verisign.com/support/ssl-certificates-support/index?page=content&id=AR227