I have an application (Cognos) which delivers web pages through two mechanisms: via IIS, and via a Java application. We need to enable SSL for both of these. IIS has been done. We are working on the Java applet now.
The IIS cert was generated by creating a cert request in IIS, sending that to the CA. They returned a certificate which we installed into IIS and thats fine - we can access these pages in the browser using HTTPS.
I tried importing this same certificate into the java applications certificate store. However I received an application specific errors.
This was done using the applications special command line tool.
But basically it looks like it's trying to replace the existing unsigned certificate under the alias encryption with a signed certificate.
Here's the page that shows the process using the provided GUI tool
My problem is that the certificate has already been returned from the CA and I didn't not generate a request in this tool.
I have a valid certificate, but I can't follow these instructions because they assume the request was generated from this keystore.
Going through the process, it seems like we need to generate a CSR from the Cognos certificate store, send that to the CA and get another certificate for the same host, but different originating CSR.
This would mean we have two certificates for the same host, which doesn't make sense to me.
- Is it OK to have two or more active certificates for the same host?
- If I have a certificate generated from a CSR from keystore A, is there any way I can import and use it in keystore B on the same server? Do I need anything from the original request to do this?
As I continue to research this I realise that when the request is generated it saves a private key in the keystore. So I think the problem isn't really that I have two keystores, the problem is that I don't know how reuse the private key from the original keystore in the second keystore