How to fix: Root installed on the server. Remove the self-signed root from the server

Question

I have a CENT OS Server and app is hosted on apache tomcat. I don't know much about SSL certificates but I did following to set it up

1 - Generate key store file

keytool -genkey -alias -keyalg RSA -keysize 2048 -keystore -sigalg SHA256withRSA

2 - Generate CSR

keytool -certreq -alias -file -keystore -sigalg SHA256withRSA

3 - Import

downloaded p7b file provided by Symantec against CSR and imported the certificate

keytool -import -alias -trustcacerts -file -keystore

Everything works fine but Symantec's SSL toolbox is showing following warning

Recommendations: Root installed on the server. For best practices, remove the self-signed root from the server.

Any ideas how can I uninstall/remove Root from Server to avoid this warning?

Answer 1

The only thing I found was this article which basically says "Browsers will receive your paid-for cert also get your self-signed cert" and it's their job to figure it out.

IMHO, Symantic's product wasted my time on a wild-goose chase. They also recommend remediating BEAST with RC4 (I assume), which is not recommended. Browsers are remediating BEAST.

BEAST
The BEAST attack is not mitigated on this server.
Root installed on the server.
For best practices, remove the self-signed root from the server.

I'd recommend this service instead: https://www.ssllabs.com/ssltest/analyze.html

Their remediation articles are very helpful.

This was the article I used to setup nginx. It needed one change to get an A+

Answer 2

To remove the root self signed certificate from tomcat, you need to remove it from your java installation. This action is performed via the keytool binary exectuable that is found on the bin folder inside your java jdk installation.

The options you should use to delete a self signed certificate from tomcat are the following:

keytool -delete -noprompt -alias ${cert.alias} -keystore ${keystore.file} -storepass ${keystore.pass}

For example, to remove a self signed cert called tomcat that i had installed on my machine, I had to use the following:

"%JAVA_HOME%\bin\keytool" -delete -noprompt -alias tomcat

More info at:

https://docs.oracle.com/javase/6/docs/technotes/tools/windows/keytool.html