I've bought a wildcard ssl certificate from a company, i sent them the csr file and they send me two certificate files namely CA.txt and com_sertificate.

I've searched on web and find some tuts about tomcat and ssl but i can not accomplish with these two files. All that tuts mention about different files that i don't have. (I asked about this process to the company that i bought certificates but they said they don't have any knowledge about tomcat integration)

Is there anyone that has an idea about this?

p.s I'm using ubuntu 8.04 server, Java 1.6 and tomcat 6

  • I've configured apache once. you probably need to rename the files so that they fit the tutorial :) CA.txt is not a good name for a cert file. I'd rename it to .pem and try it. Or maybe it's the second one. You would have to compare with the default cert file generated from command line. – naugtur Aug 17 '10 at 6:52

They probably gave you their certificates in x509 PEM format, which everything except Java uses. Java uses PKCS12. Most certificate vendors have a page of common openssl commands, including how to convert between PEM & PKCS12; here's one.

com_certificate is almost certainly your site certificate and CA.txt ... well, here's how to tell for sure:

You can use OpenSSL to inspect PEM files: openssl x509 -text -in <file>.

The "Subject" field of one of the files they sent will exactly match that of your csr; that's your site certificate. The other file will either contain their public CA certificate, an intermediate "chained" certificate, or both.

CA certificates are self-signed, which you can determine by running openssl x509 -noout -issuer -subject -in <file>. If the first line (issuer) matches the second (subject), it's self-signed, and therefore a CA cert (assuming this company is legit), so you shouldn't need to install it in tomcat.

Otherwise, it's an intermediate certificate and you'll need to convert it & add it to your keystore before adding your site certificate.


Along the lines of generating the CSR, you also must have generated a private key. After you found it, consult this document:


Well depending on which version of tomcat you are running, you have to use the corresponding documentation for your version.

In order to use SSL in Tomcat, you need to put all three files into a so called Keystore.

"To import an existing certificate signed by your own CA into a PKCS12 keystore using OpenSSL you would execute a command like:"

openssl pkcs12 -export -in mycert.crt -inkey mykey.key \
                -out mycert.p12 -name tomcat -CAfile myCA.crt \
                -caname root -chain

The follow: "Edit the Tomcat Configuration File"

  • +1, I tend to find -caname root isn't necessary. If you get a chain of CAs certificate, concatenate them (in PEM format) into the same myCA.crt file (I think from server cert issuer to root CA). – Bruno Sep 9 '10 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy