Step by step installation guide to install ssl certificates in tomcat server using keystore

Posted on October 22nd, 2023
Share this post:

Step by step installation guide to install ssl certificates in tomcat server using keystore

Prerequisites:

  1. You should have a valid SSL certificate and its associated private key in PKCS12 (PFX) or PEM format.
  2. Make sure you have access to your Tomcat server and the necessary permissions.
  3. Ensure you have Java installed on your server, as Tomcat runs on Java.

Step 1: Prepare the SSL Certificate

If your SSL certificate is in PEM format (commonly used for Apache and Nginx), you'll need to convert it to PKCS12 format, which is what Tomcat typically uses. If your certificate is already in PKCS12 format, you can skip this step.

To convert a PEM certificate to PKCS12, you can use the following command:

bash
openssl pkcs12 -export -in your_domain.crt -inkey your_domain.key -out your_domain.p12 -name your_alias

Replace your_domain.crt with your certificate file, your_domain.key with your private key file, and your_domain.p12 with the output PKCS12 file. your_alias can be any alias name you choose.

Step 2: Create a Keystore

In this step, you'll create a keystore and import your SSL certificate into it. You can use the Java keytool command to do this. If your certificate is already in PKCS12 format, you can directly import it into the keystore.

bash
keytool -importkeystore -srckeystore your_domain.p12 -srcstoretype PKCS12 -destkeystore keystore.jks

Replace your_domain.p12 with your PKCS12 certificate file and keystore.jks with the name you want to give to your keystore.

Step 3: Configure Tomcat

Navigate to the Tomcat server's conf directory and locate the server.xml file. You'll need to configure the SSL connector by adding or modifying the appropriate element.

xml
<Connector port="443" protocol="HTTP/1.1"
           SSLEnabled="true"
           maxThreads="150"
           scheme="https"
           secure="true"
           clientAuth="false"
           sslProtocol="TLS"
           keystoreFile="/path/to/keystore.jks"
           keystorePass="your_keystore_password" />

Replace the following values in the element:

  • port: Set it to the desired SSL port (usually 443).
  • keystoreFile: Provide the path to your keystore file (e.g., keystore.jks).
  • keystorePass: Enter the keystore password you set during keystore creation.

Step 4: Start Tomcat

Start or restart your Tomcat server to apply the SSL configuration.

Step 5: Test Your SSL Configuration

You can test your SSL configuration by accessing your Tomcat application using the HTTPS protocol (e.g., https://your-domain.com). Ensure that your SSL certificate is displayed as secure in your web browser.

These are the basic steps to install an SSL certificate in a Tomcat server using a keystore. The exact steps may vary depending on your Tomcat version and server environment, so be sure to consult your Tomcat documentation and the SSL certificate provider's instructions for any specific requirements.


openssl pkcs12 -export -in your_domain.crt -inkey your_domain.key -out your_domain.p12 -name your_alias

or


openssl pkcs12 -export -in cert.pem -inkey privkey.pem -out mbmis.p12 -name mb_alias

and


keytool -importkeystore -srckeystore your_domain.p12 -srcstoretype PKCS12 -destkeystore keystore.jks

or


keytool -importkeystore -srckeystore mbmis.p12 -srcstoretype PKCS12 -destkeystore keystore.jks




SSL installation in tomcat


# openssl pkcs12 -export -in your_domain.crt -inkey your_domain.key -out your_domain.p12 -name your_alias



# openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out mbmis.p12 -name mb_alias


12345678


# keytool -importkeystore -srckeystore your_domain.p12 -srcstoretype PKCS12 -destkeystore keystore.jks



# keytool -importkeystore -srckeystore mbmis.p12 -srcstoretype PKCS12 -destkeystore keystore.jks



The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using


"keytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.jks -deststoretype pkcs12".



Category:
IT , Technical Hacks etc

Posted on:
October 22nd, 2023