Java/JRE/JDK: generate self signed SSL certificate with keytool (install on web server…)

Hi,

In this article, I will try to present briefly:
1) the management of self signed SSL certificates with keytool;
2) a complete example of certificate’s generation;
3) installation on web server and tests;

1. Presentation of keytool
Java uses its own tools to generate and use self signed SSL certificates, based on a proprietary storage in a keystore file, comprised of certificates / keys accessible by alias. A keystore file is protected by password, the default keystore is that of current user(~/.keystore). It’s possible to import and export certificates/keys to be used in Java applications.

• Display the content of the current user’s keystore:
  view source

  print?

  1	C:\Users\huseyin>keytool -list

• Display the content of a keystore file:
  view source

  print?

  1	keytool -list -keystore C:\MyFiles\Development\Java\tools\sslcertificates

• Generate a self-signed X509 certificate named “myhuocert” in the keystore file:
  view source

  print?

  1	keytool -genkey -keystore C:\MyFiles\Development\Java\tools\sslcertificates -alias myhuocert -keyalg RSA

• Delete a certificate named “myhuocert” from a keystore file:
  view source

  print?

  1	keytool -delete -keystore C:\MyFiles\Development\Java\tools\sslcertificates -alias myhuocert

• Export the certificat named “myhuocert” from a keystore file:
  view source

  print?

  1	keytool -list -keystore C:\MyFiles\Development\Java\tools\sslcertificates -export -alias myhuocert -rfc

• Import a external certificate named “myhuocertimport” and protect it by password “myhuopass”:
  view source

  print?

  1	keytool -import -keystore C:\MyFiles\Development\Java\tools\sslcertificates -alias myhuocertimport -storepass myhuopass -file C:\MyFiles\Development\Java\tools\sslcertificatestoimport

The official documentation of keytool : http://java.sun.com/javase/6/docs/technotes/tools/windows/keytool.html

2. Generate a self signed SSL certificate
First, our JRE is installed in: C:\Program Files (x86)\Java\jre6\bin
..so, the following commands allow the generation of a certificate named in the keystore file “C:\MyFiles\Development\Java\tools\sslcertificates” protected by the password “javablog.fr” for a tomcat server:

Note: These commands are checked with a french system.

Answer the password for example “javablog.fr”:

Answer again the same password “javablog.fr”:

Answer your name, for example in my case “HUSEYIN OZVEREN”:

Answer the name of unit, here “JAVABLOG.FR”:

Answer the name for your organization, here “JAVA”:

Answer the name of your city:

Answer the name of your state:

Answer the code of your country on 2 characters, here “LU”:

Confirm the generation of certificate:

Press the “[RETURN]” key on keyboard:

A file named “sslcertificates” could be created in “C:\MyFiles\Development\Java\tools”.

So, if we display the content of new generated keystore file (it’s necessary to fill in the above password “javablog.fr”):

Other possibility to generate directly the certificates with one command:

Answer the password for example “javablog.fr”:

Answer again the same password “javablog.fr”:

Press the “[RETURN]” key on keyboard:

A file named “sslcertificates2” could be created in “C:\MyFiles\Development\Java\tools”.
So, if we display the content of new generated keystore file (it’s necessary to fill in the above password “javablog.fr”):

4. Configuration of SSL on tomcat and tests

Without SSL configuration, the tomcat server is started with the following traces:

Activate the following connector in the file “server.xml” of “conf” folder, to use the https protocol targeting the “C:\MyFiles\Development\Java\tools\sslcertificats” keystore with the password filled above “javablog.fr”: (keystore=”C:\MyFiles\Development\Java\tools\sslcertificats” keystorePass=”javablog.fr”):

…don’t modify the connector because, per default, the 8080 port is redirected to the 8443 port:

…and when the tomcat server is started:

If we check our configuration by access to application deployed on tomcat server (for example: https://localhost:8443/test_extJs_1/index2.html):

According to our browser, our certificate is invalid, because it doesn’t trust in our self-signed certificate. Self-signed certificates aren’t trusted by browsers because they are generated by our server, not by a CA. A certificate is self-signed if the CA is not listed in trusted CA. You can
check your SSL certificate installation on your internet server via SSL Certificate tester.

In production environment, it is necessary to buy a signed certificate from trusted SSL service provider like Verisign (the most well known CA) or Go Daddy or sign it with your own CA server. So, we must generate a Certificate Signing Request (CSR) from your server and submit it to a signing authority (see http://www.digicert.com/csr-creation.htm and http://www.turnkeylinux.org/blog/ssl-certificates).

More information: http://www.digicert.com/ssl-support/certificate-not-trusted-error.htm

Kind regards,

Huseyin OZVEREN