Contents

Popular
 Contents

Generating a Keystore

  1. Open command prompt and navigate to %JDK_HOME%/bin directory.

    Icon

    JDK8 is used in this exercise.

  2. Enter the following command, and then press Enter:

     

  3. Enter a password for the keystore. The password used in this example is ' fioranopass'.

  4. Answer all the questions pertaining to the Organization. When prompted for the First Name and Last Name, enter the fully qualified domain name (FQDN), Host Name or URL to the certificate needs to be applied.

    Icon

    When requesting a Wildcard certificate, please add an asterisk * on the left side of the Common Name.
    Example:     .mydomain.com or www.mydomain.com. This secures all subdomains of the Common Name.

    Icon

    Organization details entered must be valid. If any of these values are found invalid, CA authorities reject the Certificate Signing Request (CSR).

Generating a Certificate Signing Request (CSR)

  1. To Generate a CSR, enter the following command, and then press Enter.

  2. Provide keystore password provided in the section "Generating a Keystore" (fioranopass is used in our example)

  3. A file named "fiorano.csr" is created which contains the certificate signing request (CSR). This CSR has to be passed on to the external/third party - Certificate Authority (CA).

The CA will authenticate the certificate requestor (usually off-line) and will return a certificate or certificate chain used to replace the existing certificate chain (which initially consists of a self-signed certificate) in the keystore.

Generating SSL certificate using CSR

A third-party CA website is needed to request an SSL certificate using the CSR generated. Third party CA websites such as http://www.thawte.com and https://www.godaddy.com can be used to generate SSL certificates. In this example, a 21-day trial certificate is generated from Thawte.com and used. However, a trial certificate is not recommended for usage.


To copy the CSR, open the fiorano.csr file generated in section2, highlight it from ----BEGIN CERTIFICATE REQUEST to END CERTIFICATE REQUEST----, press Enter, and then paste it in CA website online application to generate SSL certificates.

Using certificates from a CA authority

CA authorities will send a signed certificate, intermediate certificate and root certificate. Import all such certificates into fiorano.jks keystore file.

Icon

The intermediate and root certificate should have different alias names, but the signed certificate should be imported with the same alias that was used while creating a certificate pair in "Generating a Keystore" section. Download your certificate files from your certificate authority and save them to the same directory as the keystore that you created during the CSR creation process. 

The certificate will only work with the same keystore that you initially created the CSR with. The certificates must be installed to your keystore in the correct order. 

Assuming sslcert.pem, intermediate.pem and root.pem are certificates received from CA authorities, the following commands are used to import all the certificates into the keystore:

Command 1

Command 2

Command 3

All the certificates are added to our keystore and it is ready to use.

When root and intermediate certificates are added to the keystore, a message gets displayed: "Certificate was added to keystore". When primary certificate is added to the keystore, the message displayed is: "Certificate reply was installed in keystore".

In case of no errors in this process, move to the next section Using the keystore in Fiorano.

Listing keystore entries

To list the keystore and check if all the certificates are imported successfully, use the following command:


If -v option is specified in the above command, the certificate chain length for fiorano alias is displayed:

 

Adaptavist ThemeBuilder EngineAtlassian Confluence