Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to install a geotrust chain cert in tomcat. The problem is, the cert was created using a key generated using openssl, and so it is not the same key as that in the existing keystore. I have not been able to locate info that can help me in one potential solution I thought of, which is to generate a new keystore using this existing key.

I am installing this in an appliance that runs a modified tomcat to power the web-gui. There is an included .jar script that can allow me to insert this key/cert pair into the keystore, but there is no way to pass the equivalent of keytool's -trustcacerts flag to trust a cert. This, it would seem, is causing browsers to not see the association between the final cert, and the root.

I am running keytool in the standard way I've done it for other (thawte and netsol certs) with success - it seems as though certs from at least those two providers can work without adding the -trustcacerts flag to the final cert, but the same is not true for geotrust. As usual, geotrust's support has been a total let-down.

Does anyone have any tips on how I can get this cert to work properly on tomcat, or if there is a way to create a new keystore using an existing key?

Again, I haven't included commands because they are in-part different due to various customizations, and I have validated that these same commands have worked for other cert installs (same cert-types too) in the past.

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Well, it turns out that the cert had an extra space at the end of it (not quite sure how it got there, and not immediately visible via ssh access) and that was enough to cause things to get wonky on some browsers... but I also had to combine the two certs together ssl.cert first, and intermediate second. In the past I've always done it the other way around, but here, it had to be this way, for reasons I still don't know, but customer is happy, so I get to have my weekend!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.