Ssl – Export SSL Cert from IIS and import into GlassFish keystore

Believe it or not, this functionality is not supported in keytool. The best solution I have found so far is the software and instructions available for download on this Web site.

I usually generate the key using openssl and then use this method to import the key, as that is not supported by keytool either.

To generate a 2048 bit key:

openssl genrsa -out host.domain.com.key 2048

To create a keystore from this key:

KEY=host.domain.com
openssl pkcs8 -topk8 -nocrypt -in $KEY.key -inform PEM -out key.der -outform DER
openssl x509 -in $KEY.crt -inform PEM -out cert.der -outform DER
wget http://www.agentbob.info/agentbob/81/version/default/part/AttachmentData/data/ImportKey.class
java ImportKey key.der cert.der

All you need to do is this for a Tomcat server:

1. Start with the original keystore that you used to create your CSR. This keystore has on private key in it with the alias called "tomcat"

2. From your certificate reply you will have a reply-cert , a intermediate (probably) , and also a root cert that are 3 separate files.

3. use keytool -import root cert with alias "root"

4. use keytool -import intermediate cert with alias "intermediate"

5. finally use keytool -import cert-reply.crt into keystore with alias "tomcat". this action imports the cert reply into position on top of the cert you generated when you created the keystore. this action will generate a certificate chain of length 2 or 3

6. use keytool -list to see the contents and the chain

NOTE: for an Apache server, the steps are a bit different.