Using OpenSSL to Create a Certificate Keystore for Tomcat

https://jamfnation.jamfsoftware.com/article.html?id=138

Overview

If you have a private key, an SSL certificate, and a certificate bundle from a Certificate Authority (CA), you can use OpenSSL to create a certificate keystore that Tomcat can utilize.

Requirements

The following components are required to create a keystore for Tomcat:

• OpenSSL
• Private key with a .key file extension from CA
• SSL certificate file from CA
• Certificate bundle from CA

Procedure

1. Execute the following command to create a .p12 keystore bundle from the private key, SSL certificate, and certificate bundle:

   openssl pkcs12 -export -in mycert.crt -inkey mykey.key -out mycert.p12 -name tomcat -CAfile myCA.crt -caname root -chain

2. Enter a password of “changeit” when prompted. Note: If a different password is used, it will need to be specified in the server.xml file.
3. Once the .p12 keystore bundle is created, move it to the root of the Tomcat directory.
4. Modify the server.xml file so the connector port includes the following:

   keystoreType="PKCS12"

5. Also, update the keystoreFile line of the server.xml file so that it points at the new keystore bundle.
6. Restart Tomcat. See Starting and Stopping Tomcat for instructions.
7. Browse to the JSS and verify that the correct certificate is now being used. (For example, in Safari, click the lock button in the upper-right corner of the browser window.)

 <Connector URIEncoding="UTF-8" SSLEnabled="true" clientAuth="false" 

    keystoreType="PKCS12"

    keystoreFile="/Users/jding/cert/server.p12" keystorePass="ipswitch" 

    maxThreads="150" port="8443" protocol="org.apache.coyote.http11.Http11Protocol" 

    scheme="https" secure="true" sslProtocol="TLS"/>