I created a certificate to provide SSL access to a Apache Tomcat instance using keytool:
PS C:\Programme\Java\jre7\bin> .\keytool.exe -genkey -v -keyalg RSA -alias tomcat -keypass changeit -storepass changeit -dname "CN=123.456.789.111, OU=Sth, O=Sth, L=Sth, S=Sth, C=Sth" -keystore c:\tomcat_store
After that I signed the certificate using keytool:
PS C:\Programme\Java\jre7\bin> .\keytool.exe -selfcert -v -alias tomcat -storepass changeit -keystore c:\tomcat_store
Afterwards, I can configure a
server.xml and tell the
Connector to use the above created
Having Tomcat restarted, HTTPS to the web app works fine with Firefox. The Tomcat also provides a Web Services which is consumed by a SAP system. To use this HTTPS connection the SAP system needs the self-signed SSL certificate (TA STRUST, TA SMICM).
My problem is now that SAP tells me that it can't resolve the certificate chain after a connection attempt. I assume this happens because the SAP system does not know the CA that signed the certificate.
Does someone know how I can export the signing CA from this
Keytool? What are my alternatives?