Solved

tomcat 6 (not 7) ssl problem (certificate issues)

Posted on 2014-10-10
11
375 Views
Last Modified: 2014-10-22
Hi;

I have created a keystore and CSR for SSL with the following command:
      
%JAVA_HOME%\bin\keytool -genkey -alias server -keyalg RSA \
  -keystore \path\to\my\keystore

Then I received 2 files from the certificate authority, abc.com.cer and abc.om.p7b

From this point, no matter what I have done, i couldn't make the SSL work on my Tomcat 6.
I followed the steps under, http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html
but I failed to import p7b so I convert it crt file and successfully import it.
My application for http, is using 55012 and I want to use the port 443 for https.
Following is my server.xml

<Connector port="443"
maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25"
maxSpareThreads="75" enableLookups="false"
disableUploadTimeout="true" acceptCount="100"
scheme="https" secure="true" SSLEnabled="true"
clientAuth="false" sslProtocol="TLS"
keyAlias="server" keystoreFile="/path/to/JKSfile/your_site_name.jks"
keystorePass="your_keystore_password" />

Now my questions are

1) my keystore alias is server and i send my csr after this.
To clean the things up, I want to delete my keystore but is it fine if I generate the key with another alias, e.g. tomcat as in the tomcat documentation?
2) I have the files, cer and crt (p7b), so is fine or should I need stg extra?
3) Is the order of import important?`first crt then cer?
4) What are the correct import commands? Should I trust tomcat documentation or authorities documentation?

My tomcat version is as follows:

Server version: Apache Tomcat/6.0.36
Server built:   Oct 16 2012 09:59:09
Server number:  6.0.36.0
OS Name:        Windows 7
OS Version:     6.1
Architecture:   amd64
JVM Version:    1.7.0_21-b11
JVM Vendor:     Oracle Corporation

Regards.
0
Comment
Question by:jazzIIIlove
  • 6
  • 5
11 Comments
 
LVL 61

Expert Comment

by:gheist
ID: 40374545
Java security baseline is 7u65
There is no problem with tomcat.

They sent you certificate in 2 formats. Remember that keytool needs to know that your private key has alias 'server'
0
 
LVL 12

Author Comment

by:jazzIIIlove
ID: 40374695
So while importing crt and cer, i need to use alias as server. Correct?
0
 
LVL 61

Accepted Solution

by:
gheist earned 500 total points
ID: 40375010
You need to import just one. It is same cryptographic signature in 2 different formats.
0
 
LVL 12

Author Comment

by:jazzIIIlove
ID: 40375131
Hi,

Is it abc.com.cer (which is the intermediate) or abc.com.p7b to import?

Can you write down the exact command? I am a little desperate..
0
 
LVL 61

Expert Comment

by:gheist
ID: 40375134
Consult your CA documentation. p7b is for IIS
0
How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

 
LVL 12

Author Comment

by:jazzIIIlove
ID: 40375168
Yes. I couldn't import p7b so i converted to crt to import to java keystore. So what you say is that i need to import only crt (cer is intermediate certificate and no need to import it?). And i need to use the same alias that i used to generate the CSR. Correct?

I strongly appreciate your interest in question btw. As you see, noone else is commenting currently. I would personally request  5000 pts award instead of 500pts as noone got interested in some areas inEE
0
 
LVL 61

Expert Comment

by:gheist
ID: 40375181
Would be nice if you manage to tell which CA you used and your domain name. Domain abc.com uses Apache, thats not yours I assume.
0
 
LVL 12

Author Comment

by:jazzIIIlove
ID: 40375670
java version "1.8.0"
Java(TM) SE Runtime Environment (build 1.8.0-b132)
Java HotSpot(TM) 64-Bit Server VM (build 25.0-b70, mixed mode)

It's the geotrust, https://www.geocerts.com/install/tomcat

it says,

keytool -import -trustcacerts -alias tomcat -file your_site_name.p7b -keystore mykeystore.jks
You MUST you the same alias used when the keystore was created, in this case the alias used was tomcat

the thing is that i made csr with alias "server", and also unable to install p7b, so my customer send me a converted version, crt.

Now, to be on the safe side, should i delete the keystore and regenerate the csr with alias "tomcat"?
Or should "I" convert p7b to crt file? (Note that I have the other certificate which is a cer file)

And do you think above Connector is fine?

I really wish to give the domain name but the certificate is not in place currently.

Thanks for thousand times!
0
 
LVL 12

Author Comment

by:jazzIIIlove
ID: 40375800
0
 
LVL 61

Expert Comment

by:gheist
ID: 40375899
Tomcat 6 is not compatible with java 1.8
0
 
LVL 12

Author Comment

by:jazzIIIlove
ID: 40375955
Which java should i use for tomcat 6?
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Most of the developers using Tomcat find it easy to configure the datasource in Server.xml and use the JNDI name in the code to get the connection.  So the default connection pool using DBCP (or any other framework) is made available and the life go…
Hi, in this article I'm going to teach you how to run your own site, and how to let people in (without IP). I'll talk about and explain each step... :) By the way, everything in this Tutorial is completely free and legal. This article is for …
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now