0

I have been having some issues at a client site renewing an SSL cert that previously worked fine.

I am familiar with the keytool JDK command line app, and it was how I installed the intermediate CA and SSL cert in the keystore the first time.

Current setup: 1 VeriSign intermediate CA, 1 tomcat SSL cert

End result desired: 2 new VeriSign intermediate CAs (primary/secondary) and Tomcat SSL renewal cert.

As I see it, the following are my options, but I have not been able to get these to work:

  1. Add New CAs additionally, remove original cert, add replacement cert
  2. Add New CAs additionally, add replacement cert additionally
  3. Remove old CA, add new CAs, remove original cert, add replacement cert
  4. Remove old CA, add new CAs, add replacement cert additionally

Am I missing a fifth option? I can't seem to find any more guidance on VeriSign's site, nor can I find a solution to my problem.

To make sure I've got my method right before getting into the technical details, can someone tell me what the best practice is in this case with VeriSign certs on a Tomcat (6.0.x) server?

Thanks in advance for any help you can give!

-- Sean

Improve this question

1 Answer 1

Reset to default
0

Below is the recommended steps upon installing VeriSign Intermediate CA certificates and SSL certificate to a keystore.

Step 1: Install Primary Intermediate CA Certificate

keytool -import -trustcacerts -alias primaryca -keystore (your_keystore_filename) -file primaryca.cer

Step 2: Install Secondary Intermediate CA Certificate

keytool -import -trustcacerts -alias secondaryca -keystore (your_keystore_filename) -file secondaryca.cer

Step 3: Install SSL Certificate

keytool -import -trustcacerts -alias (your_alias_name) -keystore (your_keystore_filename) -file (your_certificate_filename)

This information was obtain from VeriSign's knowledge base solution for Intermediate CAs/SSL certificate installation using Tomcat.

https://knowledge.verisign.com/support/ssl-certificates-support/index?page=content&actp=CROSSLINK&id=AR234

Improve this answer
1
  • This is indeed the correct answer. Turns out, I'd been following the correct procedure, but had not been declaring my keysize correctly. Our certificates are RSA 2048, but I'd just been declaring "-keyalg RSA", which defaults to 1024. Though it didn't solve my specific problem that led to this question, it does indeed correctly answer the question. Thanks!
    – SeanKilleen
    Mar 10, 2011 at 14:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .