Home / server / Questions / 229885
Accepted
700 Software
Asked: 2011-02-02 14:29:10 +0800 CST

Access keystore on Sun ONE Webserver 6.1 for 2048 bit key length SSL

  • 772

We want to get 2048 bit key length CSR requests. The browser based GUI provides us with a 1024 bit CSR and I don't know how to change that.

It seems that 1024 bit key lengths will no longer supported by SSL companies. (Lower cost options only support 2048 bit. Thawte who is much more expensive say they accept 1024 for only one or two year certificates, but not 3). The legacy systems in question are running Sun ONE Webserver 6.1. Upgrading would be time consuming and we would rather not have to do that right now. We will be phasing these out but it will take awhile, so...

Got it!!

http://middlewarekb.wordpress.com/2010/06/30/how-to-generate-2048-bit-keypair-using-sun-one-or-iplanet-6-1-servers/

It is for the same version webserver I am using.

/opt/SUNWwbsvr/bin/https/admin/bin/certutil -R -s "CN=sub.domain.ext,OU=org unit,O=company name,L=city,ST=spelled state,C=US,E=email" -a -k rsa -g 2048 -v 12 -d /opt/SUNWwbsvr/alias -P https-sub.domain.ext-hostname- -Z SHA1

Previous efforts edited out.

java web-server ssl sun-one keystore

2 Answers

  1. I don't have any where I can test this, so its mostly thoughts on what I'd try...

    First backup cert8.db and key.db somewhere. Then delete the originals and try making something new:

    % certutil -S -x -n nickname -t "u,u,u" -v num_of_valid_months -s subjectDN -d /opt/SUNWwbsvr/alias/https-sub.domain.ext-hostname-cert8.db [-h tokenname]

    I'm looking through the possibilities at: http://developers.sun.com/appserver/reference/techart/keymgmt.html

    Does that work? Does the following then work?

    certutil -L -d /opt/SUNWwbsvr/alias/https-sub.domain.ext-hostname-cert8.db

    If so, what happens if you restart the web server? Does it like the new cert? If it likes the cert, you could then try creating a signing request instead with 2048bits.

    • 0
  2. Best Answer

    I used the command described on this page.

    It is for the same version webserver I am using.

    /opt/SUNWwbsvr/bin/https/admin/bin/certutil -R -s \
   "CN=sub.domain.ext,OU=org unit,O=company name,L=city,ST=spelled state,C=US,E=email" \
   -a -k rsa -g 2048 -v 12 -d /opt/SUNWwbsvr/alias -P https-sub.domain.ext-hostname- -Z SHA1
    • 0