Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am in possession of the following and am attempting to create an SSL certificate to be used on an Apache Tomcat server. Usually I would generate the certificate request using keytool. However, in this case the request / response pair was pre-generated by others. Any suggestions on tooling and / or approach to accomplish this having the 3 pieces of data below?

Thanks!

-----BEGIN CERTIFICATE----- MIIFnzCCBIegAwIBAgIRAKAhdt0HU4a0O4MarQ4DGZMwDQYJKoZIhvcNAQEFBQAw ...... -----END CERTIFICATE-----

-----BEGIN CERTIFICATE REQUEST----- MIIB5jCCAU8CAQAwgaUxCzAJBgNVBAYTAkNBMQ8wDQYDVQQIEwZRdWViZWMxETAP ...... -----END CERTIFICATE REQUEST-----

-----BEGIN RSA PRIVATE KEY----- MIICXgIBAAKBgQDLfVeHiO1dCPpQYQI3X1gCVnMStitrdu7OI6iY23NowBBcwbCZ .... -----END RSA PRIVATE KEY-----

share|improve this question
    
Is it entirely sensible to have posted the private key? –  David Pashley Sep 15 '09 at 20:46
    
David: the private key is probably another 6 to 20 lines longer than that; it's just the first line which isn't all that interesting. –  freiheit Sep 15 '09 at 20:55
    
yes, I actually just mashed the keyboard for a bit to "generate" those requests/responses/keys. Well... It's the morning now. Time to try this out. Will report back shortly. –  Matty Sep 16 '09 at 11:18
add comment

1 Answer

up vote 3 down vote accepted

We use this bit of java http://www.comu.de/docs/tomcat%5Fssl/comu/ImportKey.java and something like this. Start with your three examples in separate files with .crt, .csr and .key as the extensions.

CSRFILE="$1" # the certificate request file
BASE="${CSRFILE%.csr}" 
CRTFILE="$BASE.crt" # the certificate file
CRTDER="$CRTFILE.der"
KEYFILE="$BASE.key" # the private key file
KEYPKCS="$KEYFILE.pkcs8"
KEYSTORE="$BASE.keystore"


openssl x509 -in $CRTFILE -out $CRTDER -outform der
openssl pkcs8 -in $KEYFILE -out $KEYPKCS -topk8 -nocrypt -outform der
java -Dkeystore="$KEYSTORE" comu.ImportKey $KEYPKCS $CRTDER tomcat
keytool -storepasswd -new changeit -storepass "" -keystore $KEYSTORE
keytool -keypasswd -keystore $KEYSTORE -keypass "" -new changeit -storepass changeit -alias tomcat

The chunk of BLAH=foo stuff is get everything into variables. the first two openssl commands convert the certificate and key into the binary format the Java stuff likes. The java command creates a java/tomcat friendly keystore, and the two keytool commands set the password the way tomcat seems to like it out of the box.

share|improve this answer
    
Thanks! I'll be giving this a shot first thing in the morning. Appreciate the help :) –  Matty Sep 15 '09 at 20:54
    
Works like a charm :) –  Matty Sep 16 '09 at 12:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.