{"id":210,"date":"2009-03-17T13:17:56","date_gmt":"2009-03-17T06:17:56","guid":{"rendered":"http:\/\/adityo.blog.binusian.org\/?p=210"},"modified":"2009-04-02T10:55:07","modified_gmt":"2009-04-02T03:55:07","slug":"how-to-add-new-ssl-certificate-on-tomcat-server","status":"publish","type":"post","link":"https:\/\/adityo.blog.binusian.org\/?p=210","title":{"rendered":"How to add new ssl certificate on tomcat server"},"content":{"rendered":"

How to add ssl certificate (.crt) on tomcat server<\/strong><\/span><\/p>\n

what is ssl ?<\/strong><\/span><\/p>\n

SSL (Secure Sockets Layer) is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. SSL is an industry standard and is used by millions of websites in the protection of their online transactions with their customers.<\/span><\/p>\n

To be able to create an SSL connection a web server requires an SSL Certificate. When you choose to activate SSL on your web server you will be prompted to complete a number of questions about the identity of your website and your company. Your web server then creates two cryptographic keys – a Private Key and a Public Key.<\/p>\n

The Public Key does not need to be secret and is placed into a Certificate Signing Request (CSR) – a data file also containing your details. You should then submit the CSR. During the SSL Certificate application process, the Certification Authority will validate your details and issue an SSL Certificate containing your details and allowing you to use SSL. Your web server will match your issued SSL Certificate to your Private Key. Your web server will then be able to establish an encrypted link between the website and your customer’s web browser.<\/p>\n

And i wanted to add Godaddy SSL to my tomcat server, here is my tomcat version<\/p>\n

#.\/version.sh<\/p>\n

Server version: Apache Tomcat\/6.0.14
\nServer built:\u00a0\u00a0 Jul 20 2007 04:17:30
\nServer number:\u00a0 6.0.14.0
\nOS Name:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Linux
\nOS Version:\u00a0\u00a0\u00a0\u00a0 2.6.24-16-server
\nArchitecture:\u00a0\u00a0 i386
\nJVM Version:\u00a0\u00a0\u00a0 1.6.0_06-b02
\nJVM Vendor:\u00a0\u00a0\u00a0\u00a0 Sun Microsystems Inc.<\/p>\n

Intallation Steps<\/strong><\/span><\/p>\n

1<\/span>.\u00a0 First you need to generate your new CSR and key pair<\/p>\n

Generating key pair :<\/p>\n

a. Enter the following command:
\nkeytool -genkey -alias tomcat -keyalg RSA -keystore tomcat.keystore
\nb.\u00a0 You will be prompted for a password.
\nc. Enter Distinguished Name (DN) information :
\ni.\u00a0 First and last name – This is the Common Name: Common Name: The common name is the\u00a0 fully-qualified domain name –
\nor URL – to which you plan to apply your certificate. Do not enter your personal name in this field.
\nIf you are requesting a Wildcard certificate, please add an asterisk (*) on the left side of the Common Name (e.g., “*.
\ndomainnamegoes.com” or “www*.domainnamegoeshere.com”). This will secure all subdomains of the Common Name.
\nNote: An SSL certificate only secures the exact fully-qualified domain entered as the Common Name in your certificate
\nsigning request. Thus, if your certificate secures “www.domainnamegoeshere.com,” it will not secure the domain
\n“domainnamegoeshere.com.” If you need to secure both domains you must request an SSL certificate for each of them.
\nii.\u00a0 “Organizational unit” – Use this field to differentiate between divisions within an organization. For example, “Engineering”
\nor “Human Resources.” If applicable, you may enter the DBA (doing business as) name in this field.
\niii.\u00a0 Organization – The name under which your business is legally registered. The listed organization must be the legal
\nregistrant of the domain name in the certificate request. If you are enrolling as an individual, please enter the certificate
\nrequestor’s name in the “Organization” field, and the DBA (doing business as) name in the “Organizational Unit” field.
\niv.\u00a0 City\/Locality – Name of the city in which your organization is registered\/located. Please spell out the name of the city. Do
\nnot abbreviate.
\nv.\u00a0 State\/Province – Name of state or province where your organization is located. Please enter the full name. Do not
\nabbreviate.
\nvi.\u00a0 Country code – The two-letter International Organization for Standardization- (ISO-) format country code for the country in
\nwhich your organization is legally registered.
\nd. Confirm that the Distinguished Name information is correct.<\/p>\n

Generating CSR<\/p>\n

i.\u00a0\u00a0\u00a0\u00a0 Enter the following command:<\/p>\n

keytool -certreq -keyalg RSA -alias tomcat -file <your file name>.csr -keystore tomcat.keystore
\nii.\u00a0\u00a0\u00a0\u00a0 Upon prompt, enter keystore password:
\niii.\u00a0\u00a0 If the password is correct then the CSR is created.
\niv. \u00a0 If the password is incorrect then a password error is displayed.
\nv.\u00a0\u00a0\u00a0 Cut\/copy and paste the generated CSR into godady online enrollment form. ( Then sent the csr you just generate <your file name>.csr and tomcat.keystore to the godaddy and purchase the ssl from them )
\nvi.\u00a0\u00a0 Select “Tomcat” as your server software.<\/p>\n

\n

2<\/span>.\u00a0 After you received godaddy new certification usually you will get 4 files:<\/p>\n

– gd_bundle.crt\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 – gd_intermediate.crt<\/p>\n

– gd_cross_intermediate.crt\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 –\u00a0 <your file name cst>.crt<\/p>\n

now we need to install SSL certificate and Intermediate Certificate separately<\/p>\n

I.\u00a0 Installing Root and Intermediate Certificates<\/strong><\/p>\n

Once you have downloaded the certificates to your local machine, please use the following keytool commands to import them:<\/p>\n

Root:
\n“keytool -import -alias root -keystore tomcat.keystore -trustcacerts -file valicert_class2_root.crt.”<\/p>\n

but before you run the comand you need to download valicert_class2_root.crt from godady repostiroy https:\/\/certs.godaddy.com\/Repository.go<\/p>\n

# wget https:\/\/certs.godaddy.com\/repository\/valicert_class2_root.crt –no-check-certificate
\nthen create First intermediate (gd_cross_intermediate.crt):
\n“keytool -import -alias cross -keystore tomcat.keystore -trustcacerts -file gd_cross_intermediate.crt”<\/p>\n

Second intermediate (gd_intermediate.crt):
\n“keytool -import -alias intermed -keystore tomcat.keystore -trustcacerts -file gd_intermediate.crt”<\/p>\n

Installing SSL Certificate<\/strong><\/p>\n

    \n
  1. Use the following command to import the issued certificate into your keystore.<\/li>\n
  2. keytool -import -alias tomcat -keystore tomcat.keystore -trustcacerts -file <name of your certificate, example: test.csr><\/li>\n<\/ol>\n

    it should generate tomcat.keystore files<\/p>\n

    II. Updating the server.xml Configuration File<\/strong>
    \nWhen you have completed installing your certificate, you must configure your Tomcat server.xml configuration file to point to the correct keystore file:<\/p>\n

      \n
    1. Open the server.xml file. it is usually located on \/usr\/local\/tomcat\/conf\/server.xml<\/li>\n
    2. Put this files<\/li>\n<\/ol>\n

      <Connector
      \nport=”8443″ minSpareThreads=”5″ maxSpareThreads=”75″
      \nenableLookups=”true” disableUploadTimeout=”true”
      \nacceptCount=”100″\u00a0 maxThreads=”200″
      \nscheme=”https” secure=”true” SSLEnabled=”true”
      \nkeystoreFile=”\/tomcat.keystore” keystorePass=”test”
      \nclientAuth=”false” sslProtocol=”TLS”\/><\/p>\n

      3. i use port 8433 as my ssl connection that is why i add port=”8443 not the default ssh port 443<\/p>\n

      4. Restart Tomcat.<\/p>\n

      # cd \/usr\/local\/tomcat\/bin<\/p>\n

      # .\/shutdown.sh<\/p>\n

      # export JAVA_HOME=\/usr\/lib\/jvm\/java-6-sun<\/p>\n

      # .\/startup.sh<\/p>\n

      Now go to your ssl web and checked the ssl information<\/p>\n

      \"ssl\"<\/p>\n","protected":false},"excerpt":{"rendered":"

      How to add ssl certificate (.crt) on tomcat server what is ssl ? SSL (Secure Sockets Layer) is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral. SSL is an industry […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[622],"tags":[897,896],"class_list":["post-210","post","type-post","status-publish","format-standard","hentry","category-ssl","tag-register-ssl","tag-ssl-on-tomcat-server"],"_links":{"self":[{"href":"https:\/\/adityo.blog.binusian.org\/index.php?rest_route=\/wp\/v2\/posts\/210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adityo.blog.binusian.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adityo.blog.binusian.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adityo.blog.binusian.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/adityo.blog.binusian.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=210"}],"version-history":[{"count":7,"href":"https:\/\/adityo.blog.binusian.org\/index.php?rest_route=\/wp\/v2\/posts\/210\/revisions"}],"predecessor-version":[{"id":214,"href":"https:\/\/adityo.blog.binusian.org\/index.php?rest_route=\/wp\/v2\/posts\/210\/revisions\/214"}],"wp:attachment":[{"href":"https:\/\/adityo.blog.binusian.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adityo.blog.binusian.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adityo.blog.binusian.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}