Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My employer recently purchased a Trustwave SSL certificate. Trustwave advertises support on their website, but they don't give an installation guide like they do for their other servers at all, and I am having a difficult time getting it configured correctly with GlassFish.

I found this blog post that is sort of helpful, but I'm still unable to get it working (I think the issue is that I don't fully understand the GlassFish keystore, so I am modifying it incorrectly and the server throws security exceptions on startup).

Does anyone have any experience doing so, and can you point me to a decent resource? Thanks for any help.

share|improve this question
up vote 2 down vote accepted

My experience is more focused with Jboss and Tomcat. However, I suspect it applies to Glassfish as well.

The Java keytool is what is used to manipulate keystores. If you generated the key with openssl, keytool neither supports importing nor exporting keys.

For exporting a key, this tool can be used. For importing, this tool can be used.

Depending on the type of certificate and the authority, you will likely have to import the root certificate as well.

Here are some of my notes for basic commands..

# Generate key
/usr/java/jdk1.5.0_12/bin/keytool -genkey -alias -keyalg RSA -keystore server.keystore -validity 3650

# Generate CSR
/usr/java/jdk1.5.0_12/bin/keytool -alias -keystore server.keystore -certreq -file <<**

# Import provider certs.
/usr/java/jdk1.5.0_12/bin/keytool -import -trustcacerts -alias root -keystore server.keystore -file EV_root.crt <<**

/usr/java/jdk1.5.0_12/bin/keytool -import -trustcacerts -alias Intermediate -keystore server.keystore -file EV_intermediate.crt <<**

# Import cert
/usr/java/jdk1.5.0_12/bin/keytool -import -trustcacerts -alias -keystore server.keystore -file <<**

# List certs
/usr/java/jdk1.5.0_12/bin/keytool -keystore server.keystore -list -v <<**

# Export cert
# Change 'alias' to what you want to export.
# -rfc for plaintext.
/usr/java/jdk1.5.0_12/bin/keytool -keystore server.keystore -rfc -export -alias -file <<**
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.