trying to use certs for securing connections between Tomcat 8.x and mysql/mariadb. I'm going to use a self-signed cert. What follows is what i think i should be going and appreciate you to jump in and correct me.

Create Backend(DB) certs

  1. sudo openssl genrsa 4096 > ca-key.pem
  2. sudo openssl req -new -x509 -nodes -days 3600 -key ca-key.pem -out ca-cert.pem
  3. sudo openssl req -newkey rsa:4096 -days 3600 -nodes -keyout server-key.pem -out server-req.pem
  4. sudo openssl rsa -in server-key.pem -out server-key.pem
  5. sudo openssl x509 -req -in server-req.pem -days 3600 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem

update the mysql cnf

  • ca-key.pem
  • server-key.pem
  • server-cert.pem

Ok, here's where i don't know how to proceed. I think i have to use the JAVA keytool .

Where do i go from here ?

ta OSP

1 Answer 1


The steps you described looks good for me. You don't need to use sudo for the openssl commands, though.

After those you have to import the CA certificate into the java trust store. It is called "cacerts" and dwells in the <path_to_jre>/security/ directory. Simply import the certificate with the following command:

keytool -import -trustcacerts -keystore /path/to/jre/security/cacerts \
    -file /path/to/ca-cert.pem -alias "some meaningful name"

The default password of the keystore file is "changeit".

If it is imported, you should add the useSSL=true switch to the JDBC URL, so it would look like this:


Some things to consider:

  • You don't have to use the system-wide keystore, but if you don't, you have to provide the keystore location with the -Djavax.net.ssl.trustStore=/keystore/path switch or by calling System.setProperty("javax.net.ssl.trustStore", "/keystore/path") before connecting.
  • The input file must be in PEM format (that is, a base64-encoded thing between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines).
  • The keytool command doesn't search for the certificate: it should be the first entry in the input file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .