I have a CENT OS Server and app is hosted on apache tomcat. I don't know much about SSL certificates but I did following to set it up

1 - Generate key store file

keytool -genkey -alias -keyalg RSA -keysize 2048 -keystore -sigalg SHA256withRSA

2 - Generate CSR

keytool -certreq -alias -file -keystore -sigalg SHA256withRSA

3 - Import

downloaded p7b file provided by Symantec against CSR and imported the certificate

keytool -import -alias -trustcacerts -file -keystore

Everything works fine but Symantec's SSL toolbox is showing following warning

Recommendations: Root installed on the server. For best practices, remove the self-signed root from the server.

Any ideas how can I uninstall/remove Root from Server to avoid this warning?

  • Hi, I have the same question. The Symantec SSL checker advises that this be removed, but am not sure how to remove it. Do I need to regenerate the certificate? Did you manager to work it out? – atom Mar 16 '15 at 1:59

The only thing I found was this article which basically says "Browsers will receive your paid-for cert also get your self-signed cert" and it's their job to figure it out.

IMHO, Symantic's product wasted my time on a wild-goose chase. They also recommend remediating BEAST with RC4 (I assume), which is not recommended. Browsers are remediating BEAST.

The BEAST attack is not mitigated on this server.
Root installed on the server.
For best practices, remove the self-signed root from the server.

I'd recommend this service instead: https://www.ssllabs.com/ssltest/analyze.html

Their remediation articles are very helpful.

This was the article I used to setup nginx. It needed one change to get an A+

  • 1
    Not all browsers are mitigating BEAST. The point of adjusting your server to remove support for certain ciphers to remediate a BEAST attack is to protect users from themselves. There are countless grandparents out there surfing with Internet Explorer 6 or whatever. – S. Imp Mar 14 '18 at 21:31

To remove the root self signed certificate from tomcat, you need to remove it from your java installation. This action is performed via the keytool binary exectuable that is found on the bin folder inside your java jdk installation.

The options you should use to delete a self signed certificate from tomcat are the following:

keytool -delete -noprompt -alias ${cert.alias} -keystore ${keystore.file} -storepass ${keystore.pass}

For example, to remove a self signed cert called tomcat that i had installed on my machine, I had to use the following:

"%JAVA_HOME%\bin\keytool" -delete -noprompt -alias tomcat

More info at:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.