importing self signed certificates mysql/mariadb and tomcat how to?

Question

trying to use certs for securing connections between Tomcat 8.x and mysql/mariadb. I'm going to use a self-signed cert. What follows is what i think i should be going and appreciate you to jump in and correct me.

Create Backend(DB) certs

1. sudo openssl genrsa 4096 > ca-key.pem
2. sudo openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca-cert.pem
3. sudo openssl req -newkey rsa:4096 -days 3600 -nodes -keyout server-key.pem -out server-req.pem
4. sudo openssl rsa -in server-key.pem -out server-key.pem
5. sudo openssl x509 -req -in server-req.pem -days 3600 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem

update the mysql cnf

• ca-key.pem
• server-key.pem
• server-cert.pem

Ok, here's where i don't know how to proceed. I think i have to use the JAVA keytool .

Where do i go from here ?

ta OSP

Answer 1

The steps you described looks good for me. You don't need to use sudo for the openssl commands, though.

After those you have to import the CA certificate into the java trust store. It is called "cacerts" and dwells in the <path_to_jre>/security/ directory. Simply import the certificate with the following command:

keytool -import -trustcacerts -keystore /path/to/jre/security/cacerts \
    -file /path/to/ca-cert.pem -alias "some meaningful name"

The default password of the keystore file is "changeit".

If it is imported, you should add the useSSL=true switch to the JDBC URL, so it would look like this:

 jdbc:mysql://server/database?useUnicode=true&useSSL=true

Some things to consider:

• You don't have to use the system-wide keystore, but if you don't, you have to provide the keystore location with the -Djavax.net.ssl.trustStore=/keystore/path switch or by calling System.setProperty("javax.net.ssl.trustStore", "/keystore/path") before connecting.
• The input file must be in PEM format (that is, a base64-encoded thing between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines).
• The keytool command doesn't search for the certificate: it should be the first entry in the input file.