Ssl – How to create a *.crt file out of keystore? (SSL / Tomcat)

ssltomcat

to use https (ssl) with tomcat i build a keystore with this commands:

$JAVA_HOME/bin/keytool -genkey -alias [youralias] -keyalg RSA -keystore [/preferred/keystore/path]

$JAVA_HOME/bin/keytool -certreq -keyalg RSA -alias [youralias] -file [yourcertificatname].csr -keystore [path/to/your/keystore]

Now i want to import a certificate into InternetExplorer (Menü->Internet Options->Content->Certificate-Import). The import function of the IE requires an *.crt file. So how can i create a *.crt file out of the keystore. I was looking aroung on the net to get some infos. I only found infos to create *.jks file or import *.crt to the keystore. But not erxport or create a *.crt out of the keystore.

Thx and kind regards
yefpie

Best Answer

Use OpenSSL for this, Tomcat keystore is a .p12 keystore type:

https://stackoverflow.com/questions/9497719/extract-public-private-key-from-pkcs12-file-for-later-use-in-ssh-pk-authentifica

Related Solutions

Ssl – How to update SSL certificate with Tomcat 5.5

The fact that it's registering as a TrustedCert would seem to indicate that there's no key for tomcat3. It's likely that the new certificate was requested for the existing key tomcat2. Keys themselves don't expire, just the certificates.

You can request a new certificate at any time either by generating a new cert signing request or by reusing the original one either of which is fine. Take a backup copy of your keystore and then import the certificate for the tomcat2 alias.

%JAVA_HOME%\bin\keytool -import -keystore companyname.keystore -alias tomcat2 -file 2009cert.cer

After that, you'll also want to point your tomcat instance back at tomcat2.

Tomcat – Exporting Private Key

Believe it or not, this functionality is not supported in keytool. The best solution I have found so far is the software and instructions available for download on this Web site.

I usually generate the key using openssl and then use this method to import the key, as that is not supported by keytool either.

To generate a 2048 bit key:

openssl genrsa -out host.domain.com.key 2048

To create a keystore from this key:

KEY=host.domain.com
openssl pkcs8 -topk8 -nocrypt -in $KEY.key -inform PEM -out key.der -outform DER
openssl x509 -in $KEY.crt -inform PEM -out cert.der -outform DER
wget http://www.agentbob.info/agentbob/81/version/default/part/AttachmentData/data/ImportKey.class
java ImportKey key.der cert.der

Best Answer

Related Solutions

Ssl – How to update SSL certificate with Tomcat 5.5

Tomcat – Exporting Private Key

Related Topic