what is the equivalent command for keytool add in apache/php

migrated from stackoverflow.com Aug 22 '12 at 6:31

This question came from our site for professional and enthusiast programmers.

  • You could explain what that keytool thingie does so you're able to get answer from Apache experts who may not know what it is. – Álvaro González Aug 2 '10 at 8:19

Its pretty simple, any difficulty is in generating a CSR in the first place.

openssl req -batch -newkey rsa:2048 -out something.pem

This should also give you a something.key (your private key)

(hint: find a script for the above and edit; you'll perhaps come to use it a lot).

Send that to you CA to get a certificate back. We generally ask it to be returned as suitable for 'Apache on Linux'. What that means is that you get a PEM certificate, with a chain of intermediate and root CA certificates, also in PEM. You'll likely get a concatenation of such.

To configure Apache (these are for Red Hat directories with some local naming conventions):

  • SSLPrivateKey points to /etc/pki/tls/private/something.key and the file needs to have restricted access so that root can read it no-one else.
  • SSLCertificateFile points to /etc/pki/tls/certs/something.crt (or .pem -- the actual filenames matter not at all and its more useful to just be consistent). This contains your certificate (the single PEM)
  • SSLCertificateChainFile points to /etc/pki/tls/certs/something.ca-bundle (this is my own local convention). This contains the concatelation of intermediate and root CA certificates that the server should offer. You don't need to include the root certificate, but you need to ensure that enough of the chain is present so that all of the clients can build up enough of the chain to establish trust.

To be honest, the MOST frustrating thing about this is figuring out where to put the files when you work on a different type of server (eg. Red Hat versus Debian have entirely different conventions). For the most part, it doesn't matter, UNLESS you have some sort of mandatory access control in play (eg. SELinux -- you'll want to put the files where httpd is allowed to read them file).

The other frustrating thing is figuring out how to test it. I've developed a couple of scripts (because I do this very frequently) called ssl-get-basics and ssl-rfc-xargs, which you can find in my github scriptorium repo.

Note that you can often get the CA certificate chain in one of two very confusing orders ('reverse' -- which may be opposite to your expections), and . If you use my ssl-get-basics (or openssl s_client -show-certs -connect something.example.com:443 < /dev/null | grep (for subject and issuer) then you'll want to make sure that the issuer of one certificate is the subject of the next. I've had problems with this is in the past (but that's not specific to Apache).

Also, if you find yourself needing to combine these into a keystore in the future, it is easier to combine them into a PKCS#12 keystore rather than a JKS... anything (Java) that supports a JKS will support a PKCS#12 (aka PKCS12 aka P12)


Checkout the openssl tool, which is free, non-Java: http://en.wikipedia.org/wiki/OpenSSL

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy