0

I have 2 certificates signed by CA. I want to enable ssl on tomcat using these certificates.

I ran the following commands to create jks file and imported the certificates into that jks file.

1. keytool -genkey -alias bmark.com -keyalg RSA -keystore keystore.jks
2. keytool -import -alias root -keystore keystore.jks -trustcacerts -file b32dasd75493.crt
3. keytool -import -alias intermed -keystore keystore.jks -trustcacerts -file sf_bundle-g2-g1.crt

And enabled https in server.xml of tomcat

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" keystoreFile="/Users/test/Desktop/keystore.jks" keystorePass="changeme"/>

Started tomcat and opened url https://bmark.com:8080 in chrome but it claims that CA-signed SSL certificate is not trusted, claims it is self-signed. Do I need any other files apart from these? How can I resolve this issue?

Improve this question
8
  • 2
    On your previous Q I told you THREE things: (1) you must import the server cert from the CA -- which b32dasd75493.crt almost certainly is -- to the privatekey entry which is definitely -alias bmark.com (2) 'bundle' is usually multiple certs -- if so you may need to break them apart and import them separately (3) you need to connect using the public name. You've only fixed (3), not (1) and (2). Your failure to do (1) is the reason tomcat uses and browser gets a selfsigned cert.
    – dave_thompson_085
    Jan 26, 2020 at 5:23
  • Thanks @dave_thompson_085. For (2), I have 2 certificates in the bundle.crt. I installed them separately one by one(one as root.crt and other as intermediate.crt) using the commands below: 1. keytool -import -alias root -keystore keystore.jks -trustcacerts -file root.crt 2. keytool -import -alias intermed -keystore keystore.jks -trustcacerts -file intermediate.crt. For (1) I used the command : keytool -import -alias bmark.com -keystore keystore.jks -trustcacerts -file b32dasd75493.crt. But still the same error. Let me know what Iam missing. Thanks.
    – user1188867
    Jan 26, 2020 at 12:03
  • 1
    Are you sure it's the same error (self-signed) and not a different security error? Look at the entry as Piotr says, and/or with the server running do keytool -printcert -v -sslserver $host[:$port] (this shows exactly what it is serving. Did the bundle tell you which cert is what? If not, look at each with keytool -printcert -file $file and make sure of the subject and issuer.
    – dave_thompson_085
    Jan 27, 2020 at 7:45
  • PS: is this an internal system or resolution? On the internet I get bmark.com -> 70.60.131.72 and that system gives me a cert for {,www.}antiquearts.com issued Dec 2 by letsencrypt, plus the correct letsencrypt intermediate and no root (which is permitted, but not usual for Java) and it identifies as Apache2.4.6 on CentOS not Tomcat.
    – dave_thompson_085
    Jan 27, 2020 at 7:48
  • Its internal system under our company network. The error now I am getting is NET::ERR_CERT_AUTHORITY_INVALID. Did you see the commands that i used to import, does they seem right for wild card certificate. Do I need to change anything in the hosts file to match wildcard certificate.
    – user1188867
    Jan 27, 2020 at 7:58

1 Answer 1

Reset to default
1

To check if the CA response got correctly installed run:

keytool -list -keystore /Users/test/Desktop/keystore.jks -alias bmark.com -v

It should show you your certificate chain from leaf to root.

In your connector definition you didn't specify the key alias, so the first certificate found is used. Change it to:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS"
           keystoreFile="/Users/test/Desktop/keystore.jks"
           keystorePass="changeme"
           keyAlias="bmark.com" />

or, if you are using Tomcat 8.5 (you shouldn't use Tomcat 8.0), switch to the new SSL configuration:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" scheme="https" secure="true" SSLEnabled="true">
    <SSLHostConfig protocols="TLS">
        <Certificate certificateKeystoreFile="/Users/test/Desktop/keystore.jks"
                     certificateKeystorePassword="changeme"
                     certificateKeyAlias="bmark.com" />
    </SSLHostConfig>
</Connector>

Edit: To install all three certificates you just need a file with your certificate and the intermediates in order from stem to root and run:

keytool -importcert -keystore /Users/test/Desktop/keystore.jks\
-alias bmark.com -file <chain_file> -trustcacerts

or you might insert separately from root to stem.

Improve this answer
7
  • Thanks. This worked but in the browser it is showing as NET::ERR_CERT_AUTHORITY_INVALID. I will work on this update this comment if I'm able to resolve it.
    – user1188867
    Jan 27, 2020 at 5:24
  • Did the first command give you the whole certificate chain up to you CA's self-signed certificate? You can also use KeyStore Explorer to see the certification chain visually.
    – Piotr P. Karwasz
    Jan 27, 2020 at 5:31
  • Is there any particular order we need to follow while installing certificates? when I run first command it is certificate chain lengh as 1 even though I installed 3 certificates.
    – user1188867
    Jan 27, 2020 at 5:58
  • keytool will fail if it does not find the intermediate certificates, so you need to install them from root to stem or all together.
    – Piotr P. Karwasz
    Jan 27, 2020 at 6:39
  • 1
    From the description there should be only one privatekey entry in OP's keystore in which case the alias shouldn't be needed, but it is good practice and if it helps even better.
    – dave_thompson_085
    Jan 27, 2020 at 7:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .