Create java repository from secret key and CA certificate package

I am new to configuring Jetty Server for SSL. I followed the steps from digcert. I created a private key file file , CSR certificate .

I sent a certificate request to CA and received my signed CSR. But CA sent me a packet with two certificates, one of which is my certificate signed by CA, and the second is CA Certificate. (1. Star_xyx_abc_com crt file, 2.DigiCertCA crt file). Now I am faced with the problem of creating a keystore from these files.

When I used keytool to create keystore , following Oracle docs steps 4, 5 and 6, I got an error

keytool error: java.lang.Exception: Certificate not imported, alias already exists. 

when i used openssl to create pkcs12 i got

 Loading 'screen' into random state - done Error unable to get issuer certificate getting chain. 

error.

How can I generate a KeyStore from a private key file, my certificate is signed with a CA and CA certificate?

+5
source share
3 answers

Here are the steps that I took to install the certificate.

1. Created PKCS12 with three files (private key file, my certificate, CA certificate) using the OPENSSL tool.

 openssl pkcs12 -export -out j2vproject.pkcs12 -inkey my_privatekeyfile.key -in star_xyz_abc.crt -certfile DigiCertCA.crt 

2. Create java keystore from PKCS12 using the Keytool tool.

 keytool -v -importkeystore -srckeystore j2vproject.pkcs12 -srcstoretype PKCS12 -destkeystore j2vprojectkeystore.jks -deststoretype JKS 

3. added this keystore to the server and it worked.

+1
source

Aseda: You have a certificate signed by CA, but the certificate is not a CSR signed. Some data in the certificate is the same as some data in the CSR, but not all. Also, I wonder why you followed the digicert instructions for Apache / OpenSSL and not Tomcat / Java, which would be a lot simpler because Jetty is also Java.

In any case: the instructions on this Oracle page only work if you created the secret key and CSR using the Java keytool, as described in steps 1,2,3. In addition, steps 4 and 5 + 6 are alternatives; although the text is not as clear as it may be, you do one or the other, not the one or the other - and only after completing 1,2,3.

Given that you are currently located, your only option is to convert the OpenSSL files to pkcs12 and perhaps then use keytool to convert pkcs12 to JKS. (Java crypto itself can use pkcs12 directly, but not all Java crypto applications can call this option, and I don't know if Jetty can.)

You say you tried it and didn’t provide any details about what you did, but I think that your Digicert CA file most likely has an intermediate CA and not root, and you get the whole chain you need to add root. (The full chain is not really required for the pkcs12 format and therefore the openssl pkcs12 subcommand, but very desirable for SSL / TLS like Jetty, and so you should do this.)

First check what is your (immediate) CA and what is DigicertCA.crt with

  openssl x509 -in $yourcert.crt -noout -issuer openssl x509 -in DigicertCA.crt -noout -subject -issuer 

If the issuer of your certificate is DigicertCA compliant and they (both) include something like an “intermediate CA” or “SSL CA”, and the DigicertCA issuer has a “CN” that is either DigiCert Assured ID Root CA , DigiCert Global Root CA or DigiCert High Assurance EV Root CA , then you are lucky if you (or anyone else) have not removed the digicert root from the standard cacerts in your Java (JRE). Use keytool -exportcert to copy this keytool -exportcert root from the corresponding entry in JRE/lib/security/cacerts to a file. Combine your secret key, your certificate, the intermediate certificate "DigicertCA" and the corresponding root certificate into one file and send it to openssl pkcs12 -export [-name whatever] and send the output to the file with a non-empty password.

(Other cases: if DigicertCA.crt is actually the root and matches the issuer of your certificate, that would be very strange. If it is root and does not match the issuer of your certificate, you are missing an intermediate CA cert (or maybe even more than one ), you can get it (from Digicert) if it (DigicertCA.crt) matches the issuer of your certificate and is not root, but its issuer is not one of the roots mentioned above, you will need more certificates for your chain, but without additional I cannot data summarize that.)

With the pkcs12 file do

 keytool -importkeystore -srckeystore p12file -srcstoretype pkcs12 -destkeystore newjksfile 
+5
source

I tried to add both the CA certificate chain and the cacerts from the SSL distribution and use the result as the ca certificate chain, and it worked!

 cat yourCACert.crt /etc/ssl/certs/ca-certificates.crt > fullCAChain.crt openssl pkcs12 -export -chain -CAfile fullCAChain.crt -in customercert.cer -inkey customercert.key -out customercert.keystore -name tomcat 
0
source

All Articles