Questions[keytool](server)

I'm trying to import a CA-signed certificate into my Java cacerts.

Now I've got these files:

• signing request.csr
• ca-signed certificate.crt
• ca-signed ceertificate.key
• ca.cer
• ca root.cer

According to the test API document，I need to import my ca-signed certificate.crt into my JDK1.8 cacerts before running my java code. I tried to import the certificate to my java cacerts like this:

keytool -import -trustcacerts -file D:\JavaWebTest\keytool_test\ca-signed certificate.crt -alias myalias -keystore cacerts

But using keytool -list command, it shows a trustedCertEntry type. While my help document says "check the keystore to confirm your certificate(s) were added. The output should contain an entry type:PrivateKeyEntry and a entry type :trustedCertEntry for each issued certificate."

Then I tried to import all files (except .csr) into a jks keystore and the output contains an entry type:PrivateKeyEntry. But when I run the keytool command to import it into my java cacerts, there is an error saying that this file is not an X.509 certificate. I don't know how to resolve this problem.

By the way, when I use curl with ca-signed certificate.crt and ca-signed certificate.key to access the test https API, it successed.

Thanks. This problem has bothered me about two weeks...

The version details :

Using CATALINA_BASE:   /apps/TOMCAT/tomcat
Using CATALINA_HOME:   /apps/TOMCAT/tomcat
Using CATALINA_TMPDIR: /apps/TOMCAT/tomcat/temp
Using JRE_HOME:        /usr
Using CLASSPATH:       /apps/TOMCAT/tomcat/bin/bootstrap.jar:/apps/TOMCAT/tomcat/bin/tomcat-juli.jar
Server version: Apache Tomcat/8.5.4
Server built:   Jul 6 2016 08:43:30 UTC
Server number:  8.5.4.0
OS Name:        SunOS
OS Version:     5.11
Architecture:   sparcv9
JVM Version:    1.8.0_92-b14
JVM Vendor:     Oracle Corporation

Keytool list :

keytool -list
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 3 entries

root, Sep 16, 2016, trustedCertEntry,
Certificate fingerprint (SHA1): xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
intermediate, Sep 16, 2016, trustedCertEntry,
Certificate fingerprint (SHA1): xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:
server, Sep 16, 2016, PrivateKeyEntry,
Certificate fingerprint (SHA1): xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:

The server.xml connect

    <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
         This connector uses the NIO implementation with the JSSE engine. When
         using the JSSE engine, the JSSE configuration attributes must be used.
    -->


   <Connector
        port="8443"
        protocol="org.apache.coyote.http11.Http11NioProtocol"
        maxThreads="150"
        SSLEnabled="true"
        keystorePass="XXXXX"
        sslProtocol="TLS"
        clientAuth="false">
        scheme="https"
        keyAlias="server"
        certificateKeystoreFile="/apps/JAVA/tomcat.jks"
<!--        <SSLHostConfig>
            <Certificate certificateKeystoreFile="/apps/JAVA/tomcat.jks"
                         type="RSA" />
        </SSLHostConfig>
-->
    </Connector>

I'm running a configtest.sh and i get the following :

SEVERE: Failed to initialize end point associated with ProtocolHandler ["https-jsse-nio-8443"]
java.lang.IllegalArgumentException: java.io.IOException: Alias name tomcat does not identify a key entry
.
.
SEVERE: Failed to initialize connector [Connector[HTTP/1.1-8443]]
org.apache.catalina.LifecycleException: Failed to initialize component [Connector[HTTP/1.1-8443]]
.
.
Caused by: org.apache.catalina.LifecycleException: Protocol handler initialization failed
        at org.apache.catalina.connector.Connector.initInternal(Connector.java:1012)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:107)
        ... 12 more
Caused by: java.lang.IllegalArgumentException: java.io.IOException: Alias name tomcat does not identify a key entry
        at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:103)
        at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:81)
        at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:245)
        at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:866)
        at org.apache.tomcat.util.net.AbstractJsseEndpoint.init(AbstractJsseEndpoint.java:213)
        at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:558)
        at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:65)
        at org.apache.catalina.connector.Connector.initInternal(Connector.java:1010)
        ... 13 more
Caused by: java.io.IOException: Alias name tomcat does not identify a key entry
        at org.apache.tomcat.util.net.jsse.JSSEUtil.getKeyManagers(JSSEUtil.java:213)
        at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:101)
        ... 20 more

1. I cannot make out where it picks up the alias tomcat
2. The keyalias specified in the server.xml doesn't look like having an impact
3. The entry certificateKeystoreFile="/apps/JAVA/tomcat.jks" didn't have an impact and i had to create a $USER/.keystore file

as anyone come across this and how do i rectify this ?

cheers OSP

I have a keystore on one machine (at /root/.keystore) and I want to move it to another machine at the same location. Currently, the second machine doesn't have a keystore at /root/.keystore, is there a way I can export then create/import? Or do I need to create an empty one first?

I have a problem with keytool tool.

I have a FishEye/Crucible server which needed to be connected to my Jira server. My Jira server uses SSL. I'm trying to import ssl certificate using the following command:

 keytool -importcert -alias "JiraCert" -file jira.crt -keystore $JAVA_HOME/jre/lib/security/cacerts
Enter keystore password:  
Keystore password is too short - must be at least 6 characters
Enter keystore password:  
Keystore password is too short - must be at least 6 characters
Enter keystore password:  
Keystore password is too short - must be at least 6 characters
Too many failures - try later

but it asks for password which is empty one as I managed to list available certificates in that keystore with no password, just Enter is pressed.

What do you think, what shall I do?

Is there anywhere that I can get a valid , signed, SSL cert to the "localhost" domain for testing? Does anyone anywhere offer a download of something like this that I can use in testing? I know how to use openssl to sign a key with a CA, but there are a lot of steps involved and I am hoping there is something quick and easy.

What I want is a canned test CA that I can import into my trusted CA stores and then a accompanying jks keystore that has the cert chain in it for that CA.

So, it would be a 3 step process, within a protected sandbox :

   1.  Get a new distro of Jetty, enable the SSL connector, point it to 
       the localhost.jks keystore
   2.  Import the CA that signed the localhost cert in the localhost.jks 
       into my web browser
   3.  Browse to Tomcat on the SSL port , look at the cert and see the 
       cert chain.