According to http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html#Create_a_local_Certificate_Signing_Request_(CSR) I can use keytool to generate the key and cert for tomcat but can I use openssl?

If yes, is there any openssl guideline for tomcat?

Respond to: Mr Valerio Minetti

Yes, the goal is we want to setup the SSL on a tomcat server.
One of my colleagues created the CSR and sent to Thawte, and Thawte return us cert file.
Because my colleague is busy, he hand over this job to me, to setup the tomcat.
After investigating (not the openssl), the fact is my colleague created the CSR by Symantec SSL assistance.

Symantec generated 2 files:


My colleague use www_xxxxxxxxxx_com_rsa_csr.txt to apply cert from Thawte.

So now I need to do the following steps?

  1. using the keytool to create keystore
  2. then import the private key www_xxxxxxxxxx_com_rsa_private.key
  3. import the chain cert from Thawte
  4. import our site cert

Am I correct?


1 Answer 1


You can generate certs and keys with openssl, but in order to have tomcat using them you will have to use keytool to import it in a tomcat keystore.

you can find some examples here: link

  • Oh thanks, I add more details by edit my question.
    – user132206
    Aug 23, 2013 at 8:19
  • That's fine, u have to import signed cert, private key and chain cert into your keystore, and then tell tomcat where your keystore is. Aug 23, 2013 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy