Environment: Tomcat 7.0 on Windows 2008 R2
What to accomplish
Get Tomcat 7.0 to use a specific wildcard certificate with accompanying cert chain so customers' browsers do not throw errors. The provided certificate is a wildcard cert. This is non-negotiable and irrelevant to getting the certificate installed.
My problem is that I cannot get tomcat to use the chain (root certificates) in addition to the main cert.
What I've tried
At first it took me forever to get the certificate working with the provided key pair. References 2 and 3 showed me these steps to import a provided key pair as a "PrivateKeyEntry" which Tomcat likes better:
#on a CentOS server cuz easier than getting a windows tool for it openssl pkcs12 -export -in wildcard-customer-2016.crt -inkey wildcard-customer-2016.key -out wildcard-customer-2016.p12 -name wildcard -CAfile rapidssl.crt -caname root #back on windows C:\Program Files\Java\jre7\bin\keytool -importkeystore -deststorepass tomcat -destkeystore c:\.keystore -srckeystore c:\certificate\wildcard-customer-2016\wildcard-customer-2016.p12 -srcstoretype PKCS12 -alias wildcard
But I don't know how to add the root certificate so that it uses that as well. You can see the command I used to build the .p12 file included a CAfile command. The importkeystore command when run with a "-trustcacerts" didn't add the root certs, although it did work with the *.customer.com cert.
Somebody explain how to configure my
server.xml for using APR properly. Pretend I don't know where the files from the zip file go. (Reference 4)