I have a working crt file imported into tomcat keystore and I need a certificate file and private key file in pem to uplaod to aws cloudfront.
Our SSL cert issued by go-daddy to use the cert for tomcat, hence I have the following files :
tomcat keystore works fine when configured properly. However the cert is a wildcard cert and we also need to upload it aws to be used in cloudfront. aws cli upload method needs pem cert file. I have tried converting this to pem using openssl . However my first problem is jdk error in converting the cert. Secondly whatever part I am able to convert was not verified by openssl .
What I have in my keystore
$ keytool -list -keystore tomcat.keystore Enter keystore password: Keystore type: JKS Keystore provider: SUN Your keystore contains 3 entries mydomain, Oct 24, 2013, PrivateKeyEntry, Certificate fingerprint (MD5): XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX root, Oct 24, 2013, trustedCertEntry, Certificate fingerprint (MD5): XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX intermed, Oct 24, 2013, trustedCertEntry, Certificate fingerprint (MD5): XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Converting keystore to pem
$ keytool -importkeystore -srckeystore tomcat.keystore -destkeystore intermediate.p12 -deststoretype PKCS12 Enter destination keystore password: Re-enter new password: Enter source keystore password: Entry for alias mydomain successfully imported. Problem importing entry for alias root: java.security.KeyStoreException: TrustedCertEntry not supported. Entry for alias root not imported. Do you want to quit the import process? [no]: no Problem importing entry for alias intermed: java.security.KeyStoreException: TrustedCertEntry not supported. Entry for alias intermed not imported. Do you want to quit the import process? [no]: no Import command completed: 1 entries successfully imported, 2 entries failed or cancelled $ openssl pkcs12 -in intermediate.p12 -out mydomain.pem -nodes Enter Import Password: MAC verified OK $ openssl verify mydomain.pem mydomain.pem: OU = Domain Control Validated, CN = *.mydomain.com error 20 at 0 depth lookup:unable to get local issuer certificate
Looks like that I first need to get past the jdk error.
java -version java version "1.6.0_24" OpenJDK Runtime Environment (IcedTea6 18.104.22.168) (amazon-22.214.171.124.90.55.amzn1-x86_64) OpenJDK 64-Bit Server VM (build 20.0-b12, mixed mode)