Notice: This Wiki is now read only and edits are no longer possible. Please see: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/wikis/Wiki-shutdown-plan for the plan.
Difference between revisions of "Generating a Private Key and a Keystore"
m (Added tag for left menu) |
|||
| Line 1: | Line 1: | ||
| + | {{#eclipseproject:technology.higgins}} | ||
1. To generate a keystore, you need a JDK installed with its /bin directory in your path | 1. To generate a keystore, you need a JDK installed with its /bin directory in your path | ||
Revision as of 08:47, 15 March 2008
{{#eclipseproject:technology.higgins}} 1. To generate a keystore, you need a JDK installed with its /bin directory in your path
2. Create a keystore using this command:
keytool -genkey -alias tomcat -keyalg RSA -keystore keystore.jks
keytool will ask you to enter the values for Common Name (CN), Organizational Unit (OU), Oranization(O), Locality (L), State (S) and Country (C). CN should match the domain name of your webapp if you are planning to use this keystore for your servlet container
You can verify keystore contents using this command:
keytool -list -v -keystore keystore.jks
3. Generate the Certificate Signing Request (CSR) using this command:
keytool -certreq -v -alias tomcat -file csr-for-myserver.pem -keystore keystore.jks
Submit contents of csr-for-myserver.pem file to your CA for signing
You can get a trial certificate from Thawte at https://www.thawte.com/cgi/server/try.exe
4. Save the signed certificate from CA to a file signed-cert.pem
You can see the contents of the signed certificate using this command:
keytool -printcert -v -file signed-cert.pem
5. Download Root certificate from CA. You can download Thawte Test Root Certificate from http://www.thawte.com/roots/.
6. Import Root Certificate to keystore using this command:
keytool -import -v -noprompt -trustcacerts -alias cacert -file root-cert.pem -keystore keystore.jks
where root-cert.pem is the Root Certificate from CA
7. Verify contents of keystore using this command:
keytool -list -v -keystore keystore.jks
8. Import CA signed certificate to keystore
keytool -import -v -alias tomcat -file signed-cert.pem -keystore keystore.jks
9. Verify contents of keystore using this command:
keytool -list -v -keystore keystore.jks
The most important thing you want to see is that, under the private key alias, additional information is being displayed. You're looking for this:
Certificate chain length: 2