Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm needing an experienced person to guide me on this little project :-)

We have one Domain Controller [Win2k8 R2] with the Active Directory Certificate Services role. Let's call it

I've got a second Windows 2008 R2 server,, that runs an Apache Tomcat web server. We are setting up an Outlook plug-in for all users that requires an SSL connection to an OAuth server. I fumbled through the instructions to add the OAuth module to Tomcat and enable a connector using SSL on port 8443 [default SSL port for Tomcat].

But now I don't know how to "put 2 and 2 together" -- How can I generate a certificate from our internal CA so there are no SSL certificate errors when connecting to So far I made the "keystore" file on ServerTwo using the JRE "keytool.exe" program, and of course the certificate shows it [like, when you click the lock icon in a browser] as a self-signed cert with no CA chain.

Any help in this area is greatly appreciated.

share|improve this question
Are your client systems on an AD domain? – Shane Madden Sep 5 '12 at 3:57
Yes, with three Domain Controllers, one of which is ServerOne. – armani Sep 5 '12 at 13:06
Was the certificate services role configured as stand-alone or AD integrated? – Shane Madden Sep 5 '12 at 15:55
Not sure; That server was set up before my time. Is there a way I can find out? – armani Sep 5 '12 at 16:42
In the Certificate Services MMC snap-in, is there an entry for "Certificate Templates" in the left-hand navigation tree? – Shane Madden Sep 5 '12 at 17:53
up vote 1 down vote accepted

I ended up figuring this out on my own. I documented my steps; Hopefully this helps anybody with the same issue in the future:

  1. Generate CSR on Tomcat

    • Create the keystore and private key: keytool -genkey -alias tomcat -keyalg RSA -keystore keystore
    • "Keytool" is in your Java's JDK or JRE home directory's "bin" folder
    • "keystore" includes the path to your keystore file, such as "C:\store\keystore"
    • Fill out the information it asks, noting that "first and last name" is really asking for the FQDN
    • Create the CSR file: keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore keystore
    • [I then copied to a common share:] copy certreq.csr Z:\
  2. Sign the certificate

    • On the server with Active Directory Certificate Services role, in an elevated command prompt: certreq -submit -attrib "CertificateTemplate: WebServer" Z:\certreq.csr certificate.cer
    • Choose the CA you're working on in the popup
    • [Then I copied back to the share:] copy certificate.cer Z:\
  3. Import the Root CA certificate

    • On the server with Active Directory Certificate Services role:
    • Server Manager --> Roles --> Active Directory Certificate Services --> [Your CA] --> Issued Certificates
    • Open any from the list signed by your CA, go to the Certification Path tab
    • "View Certificate" for the root CA, if it is your server's CA
    • Details tab --> Copy to File... [then I saved to Z:\RootCA.cer]
    • On the Tomcat server:
    • keytool -import -trustcacerts -alias rootca -file Z:\RootCA.cer -keystore keystore
    • Type "yes" to trust the certificate
  4. Import the certificate for Tomcat

    • keytool -import -trustcacerts -alias tomcat -file Z:\certificate.cer -keystore keystore


Note, if at this point your browser still doesn't trust that it was signed by a trusted Root CA, you may have to push out the Root CA server through Group Policy . . . It was a quick Google for me. I had already set that up before these steps, so I'm not sure if it matters or not.

share|improve this answer

Well as you have just created a self signed certificate, this is not going to be automatically authenticate as you are not a trusted certificate authority.

Easiest and quickest thing to do is to just install the certificate into your local trusted certificate store, but you will need to do this on each machine, so this will be quite time consuming and will cause problems when you setup a new machine a year in the future and forget to do this, so a better way to deploy it would be to use GPO. If you have group policy setup, follow the instructions here.

share|improve this answer
I meant to mention that I wanted to avoid this route due to the downsides you have mentioned. Since all computers see ServerOne as its domain controller, is there no trust? Shouldn't they view it as a trusting root CA? – armani Sep 5 '12 at 3:12
And actually, I tried this and it didn't even work. :( – armani Sep 5 '12 at 18:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.