Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <tomcat-user@jakarta.apache.org>
Received-SPF: neutral (hermes.apache.org: local policy)
Message-ID: <4148F436.8030506@ddai.net>
Date: Wed, 15 Sep 2004 19:02:30 -0700
From: Dennis Dai <ml@ddai.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
 rv:1.7.3) Gecko/20040910
MIME-Version: 1.0
To: Tomcat Users List <tomcat-user@jakarta.apache.org>
Subject: Re: SSL certs
References: <20040915130513.68DC25CC61@mail.ddai.net>
In-Reply-To: <20040915130513.68DC25CC61@mail.ddai.net>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

On 9/15/2004 6:04 AM, SH Solutions wrote:

> I want to install SSL to my tomcat server.
> I do have a signed ceritificate as .key, .csr and .crt files.
> How do I get tomcat to use these?

I'd assume those files are in PEM format. Then you can use openssl to 
convert the .key and .crt files to PKCS12 format (usually .p12 or .pfx), 
which is the other keystore format java recognizes besides its 
proprietary JKS format.

But, there's a catch. If your cert is not signed by a root CA but by an 
intermediate CA, you'll need to include the whole certification chain as 
well in the converted keystore. Not only that, you will need to give 
each of the certificate a name (alias in keytool's term) when doing the 
conversion and they need to be in a particular order (from bottom - your 
cert - to top, IIRC), otherwise, the chain wouldn't be recognized by 
java. So, as long as you can see the chain from 'keytool -list' command, 
you're set.

HTH,

-- 
Dennis Dai
ml@ddai.net

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org