-
Generating your private key
Using the JDK keytool utility you can generate your own X509 certificates,
but be aware this is a memory intensive operation. In generating a certificate
you will need to give information to the keytool utility, do not lose
this information. At the command prompt (presuming that JDK_HOME/jre/bin
is in your path) enter:
$ keytool -genkey -alias name -keyalg RSA
Important: The program will not work without the -keyalg
RSA option. Netscape uses RSA encryption, but the keytool uses DSA
by default. At this point you will be prompted if the information is correct,
if it is then the program will proceed to generate a self signed certificate
and key. This may take some time.You will finally be prompted for a password
for the certificate. Make a note of this as you will not be able to use
the certificate without it.
Do not attempt to run this command until you have changed your
java.security file as described above. If you do you will get:
keytool error: KeyPairGenerator not available
An RSA enabled provider is not provided with the default JDK1.2
Once you run the keytool command you will then be prompted for the following information:
-
keystore password - if this is the first time that you are running this,
it will create a keystore in your home directory and you will be prompted
to create a keystore password. You will need this password every time you
use any key management. The alias is the name that will identify the key
in the keystore, you can have several keys in your keystore. If you do
not specify an alias the default name is mykey.
-
First and Last name e.g. "www.whitehouse.com"
-
Name of organizational unit. This is not a company name, but the name of
an internal department. e.g. "White House".
-
Name of your organization e.g "US Government"
-
City or location e.g "Washington"
-
State or Province eg "District of Columbia"
-
Country code e.g. "USA"
I find the use of first and last name to be confusing, it really wants the Fully Qualified Domain Name (FQDN) of the host that you are running your server on. In other SSL implementations they ask for the Common Name. Its important that you get this right, your certificate authority will not issue a certificate without it.
Note: Once you have entered the key information you will be prompted for a password for the private key,
with the default option being that the password will be the same as the keystore.
You must choose the default option. This is a bug, that should be fixed in the
next version of Enhydra.
To verify that the key was properly created in the keystore you can verify
it with:
$ keytool -list
-
Generating a certificate request
If you want a certificate from a recognized certificate authority, or
your own self signed certificate
you will need to generate a certificate request. Once you have the
certificate request you can submit it to your certificate authority, or issue
your own self signed certificate using either keytool or OpenSSL.
-
At the command prompt type:
$ keytool -alias name -certreq -file filename
Where name is the alias of the key in the keystore that your generating the request
against.
The specified file will be where the certificate request will be written
to. If not specified the request will be output to standard out.
If successful the certificate request should look like:
-----BEGIN NEW CERTIFICATE REQUEST-----
MIIBuzCCASQCAQAwezELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEzARBgNVBAcT
CnNhbnRhIGNydXoxDzANBgNVBAoTBmx1dHJpczEbMBkGA1UECxMSc2VjdXJlIGRldmVsb3BtZW50
MRQwEgYDVQQDEwtzdGV2ZSBsYXRpZjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAuunCyGrr
wCCZeUAJrCvoN/n82k8IF1OwH7KNzAyaPgMU6L7CcawvWqVQY/TncHZmy5tvIlNaEJR300Ha8Keo
TxWIG7T/GHgwqBcjmt/reZbvKdKxBnT7ocoWx2G5BjHoN8RxMLQtZIc/vd9QUrelfw3WMTSLoT4A
QJiAOQpcSvECAwEAAaAAMA0GCSqGSIb3DQEBBAUAA4GBAEkeC/6FzrLO0EUAg0zaIDHazB7kKqZH
cbxpAhPC1/x9ow5D/BOwUf114lMK1L8rNDSv9UlTrRJfG36cNFHIiomu42kUovFV774Ad0up6IF0
AFFOXitH2CiZVM5458NVECGdlNauRvjpwQvsRcRHC2rEpfTD0db9ISH/lN0JmDUz
-----END NEW CERTIFICATE REQUEST-----
The first and last lines with BEGIN
and END
are part
of the certificate request and should not be removed.
If you want to validate the certificate request use OpenSSL or keytool. Why use OpenSSL if its not java based ?
OpenSSL is more robust and has a more refined set of command line tools than keytool. OpenSSL is an open source implementation of the
SSL, and TLS protocols. Its widely used with the apache mod_ssl package to provide SSL servers. If you have any doubts
about open source crypto packages, note that openssl and mod_ssl are used by three commercial Apache vendors as the
basis for their secure servers. See http://www.openssl.org and http://www.modssl.org for downloads and documentation. Once OpenSSL is installed run the command:
$ openssl req -noout -text -in csr
where csr is the name of the file containing your Certificate request.
- Submitting your certificate request
To submit your certificate to a recognized certificate authority, see the instruction on their
web page. Two well known certificate authorities are: http://www.thatwte.com
and Versisign.See the instructions on their respective pages.
If you are doing development and are creating your own self signed certificate run the command:
$ keytool -sefcert -alias keyname
where keyname is the alias of the key you want to associate with the certificate. Once run the certificate will be stored in the keystore.
To validate the certificate, first export the export from the keystore:
$ keytool -export -alias name -file filename
where name is the alias of the associated key, and filename is the name of the file that the certificate will
written to.
Now read of the certificate information:
$ keytool -printcert -file file
Where file is the name of the file with the exported certificate.
-
Importing a certificate
If you are using a certificate authority to issue your certificate, you will receive a file that looks like:
-----BEGIN CERTIFICATE-----
MIIC3DCCAkWgAwIBAgIDATZXMA0GCSqGSIb3DQEBBAUAMIHEMQswCQYDVQQGEwJa
QTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xHTAb
BgNVBAoTFFRoYXd0ZSBDb25zdWx0aW5nIGNjMSgwJgYDVQQLEx9DZXJ0aWZpY2F0
aW9uIFNlcnZpY2VzIERpdmlzaW9uMRkwFwYDVQQDExBUaGF3dGUgU2VydmVyIENB
MSYwJAYJKoZIhvcNAQkBFhdzZXJ2ZXItY2VydHNAdGhhd3RlLmNvbTAeFw0wMDA3
MjQyMjMyNDBaFw0wMTA4MDcyMjMyNDBaMHoxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
EwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpTYW50YSBDcnV6MSIwIAYDVQQKExlMdXRy
aXMgVGVjaG5vbG9naWVzLCBJbmMuMR0wGwYDVQQDExRiZWVsemVidWIubHV0cmlz
LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA4pMbXgVD0jBrQHW5Xqpj
jfSQ70HzCwagrUyHPtV5LbvLffInJ2mAhihlqwPxCmr0HnYIioDxtJgr/3gqfL9C
IC1/L1xlEx06IKBkFs9X4XVXPay2DzFFGnpvCvSlEjCYobHpK+QqwF8bJrnEa9Bd
oyLyxkGBGthaQkxUJARus+MCAwEAAaMlMCMwEwYDVR0lBAwwCgYIKwYBBQUHAwEw
DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQQFAAOBgQC6xEHb6Is9jUJUf06XfWiD
wrZ4/IOYnA52bg54NVTTyjjl3qxcQpanAwajp6aAnWUYb34MuRZ8dpsYVu3TUjNF
xxgv0MWQByb4LIjv+l2JcTO4a5ZmFp7Kqp6U2XgdgcS2YYxG+mMQmTdJ3PjCB4Od
g3TILQ8TdSHnSG4YaQgNPw==
-----END CERTIFICATE-----
You can verify that it with openssl:
$ openssl x509 -noout -text -in enhydra.crt
Or else by using keytool:
$ keytool -printcert -v -file crt
Where crt is the name of the file containing the certificate.
Note: keytool and openssl will handle certificates in different ways. keytool will complain that a
certificate is unreadable if it does contain a new line at the end of the file, while openssl will have
no such problem.
Once you have verified your certificate you can
import it into your keystore by issuing the command:
$ keytool -import -alias name -file certfile -trustcacerts
Where certfile is the name of the issued certificate file, name is the name of
the alias that you want to associate with the certificate. The trustcacerts option tells
keytool to look in the cacerts file that can be found in the
JDK/jre/lib/security directory. This file contains the root certificates
for Thawte and Verisign and keytool uses them to verify the certificates you input
into the keystore.
Note: If you are using a Certificate authority other than Thawte or Verisign you will have to import their
root certificates into the JDK/jre/lib/security/cacerts file. To do this download the root certificate files
from your Certificate Authority. then run keytool:
$ keytool -import -alias name -file filename -keystore cacerts
where name is the alias that you want to associate with the certificate and filename is the name of the
file containing the root certificate.