- Chaining and Establishing Identities
- Generating a Private Key and a Keystore
- Building the Keystore
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Building the Keystore
Now — finally — I am ready to build the keystore.
The first step is to import the root and where applicable, the intermediate, certificate just mentioned, using the following command:
D:\ssl-article\examples>keytool -import -v -noprompt -trustcacerts -alias verisigndemocert -file verisign-demo-root-cert.pem -keystore server_key store.jks -storepass weblogic1234 Certificate was added to keystore [Saving server_keystore.jks]
The message indicates that the certificate was imported successfully. Remember to give all your certificates a unique alias. I usually use CA-root-cert or CA-int-cert, where CA is the name of the Certificate Authority.
Two arguments are noteworthy at this point: -trustcacerts and –noprompt.
The –trustcacerts argument tells keytool that you want to import this as a trusted certificate. There are implications of this in other SSL configurations; for now, just be aware that you only want to import certificates as trusted certificates in very specific situations, such as when you are building an identity keystore.
The –noprompt argument turns off a prompt that asks you if you are sure that you want to import this certificate as a trusted certificate. Unless you are very comfortable with SSL configuration, I'd recommend not using this option, but you should be aware of it.
Next, verify the contents of the keystore again:
D:\ssl-article\examples>keytool -list -v -keystore server_keystore.jks -storepass weblogic1234
Keystore type: jks
Keystore provider: SUN
Your keystore contains 2 entries
Alias name: servercert
Creation date: Mar 4, 2005
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=jsvede.bea.com, OU=DRE, O=BEA, L=Denver, ST=Colorado, C=US
Issuer: CN=jsvede.bea.com, OU=DRE, O=BEA, L=Denver, ST=Colorado, C=US
Serial number: 42291b03
Valid from: Fri Mar 04 19:35:47 MST 2005 until: Thu Jun 02 20:35:47 MDT 2005
Certificate fingerprints:
MD5: D4:55:EA:25:FF:1A:1C:22:F5:3E:76:53:36:96:CF:93
SHA1: 82:3F:73:37:A5:B9:A0:24:F4:E4:CA:0F:E8:A9:0B:CB:41:2F:F0:29
Alias name: verisigndemocert
Creation date: Mar 4, 2005
Entry type: trustedCertEntry
Owner: OU=For VeriSign authorized testing only. No assurances (C)VS1997, OU=http://www.verisign.com/repository/TestCPS Incorp. By Ref. Liab. LTD., O="Ve
riSign, Inc"
Issuer: OU=For VeriSign authorized testing only. No assurances (C)VS1997, OU=http://www.verisign.com/repository/TestCPS Incorp. By Ref. Liab. LTD., O="V
eriSign, Inc"
Serial number: 52a9f424da674c9daf4f537852abef6e
Valid from: Sat Jun 06 18:00:00 MDT 1998 until: Tue Jun 06 17:59:59 MDT 2006
Certificate fingerprints:
MD5: 40:06:53:11:FD:B3:3E:88:0A:6F:7D:D1:4E:22:91:87
SHA1: 93:71:C9:EE:57:09:92:5D:0A:8E:FA:02:0B:E2:F5:E6:98:6C:60:DE
Now the keystore has the private key and the root certificate. We need to import the server certificate.
To do this, we use the import command again, but we drop the –trustcacerts and –noprompt, and we specify that the alias is the same as the private key alias. This is a little counter-intuitive, but when we do this, keytool understands that we are trying to establish a relationship between this certificate and the private key.
I run this command only after I have imported the root certificate and any intermediate certificates. Having these files available allows the keytool to properly chain your signed certificate to the proper root certificates. If you do not do this in this order, you may have problems when you try to use your SSL port.
This activity of importing the public certificate is often referred to as creating the chain. This is accomplished using the following command:
D:\ssl-article\examples>keytool -import -v -alias servercert -file jsvede-signed-cert.pem -keystore server_keystore.jks -keypass weblogic1234 -st orepass weblogic1234 Certificate reply was installed in keystore [Saving server_keystore.jks]
Again, keytool provides useful messaging, letting you know that it understood this certificate to be the certificate for key that is identified by the alias servercert.
Finally, if you do another listing of the keystore, it should look like this:
D:\ssl-article\examples>keytool -list -v -keystore server_keystore.jks -storepass weblogic1234
Keystore type: jks
Keystore provider: SUN
Your keystore contains 2 entries
Alias name: servercert
Creation date: Mar 4, 2005
Entry type: keyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=jsvede.bea.com, OU=DRE, O=BEA, L=Denver, ST=Colorado, C=US
Issuer: OU=For VeriSign authorized testing only. No assurances (C)VS1997, OU=http://www.verisign.com/repository/TestCPS Incorp. By Ref. Liab. LTD., O="V
eriSign, Inc"
Serial number: 55dd72adfbf6f39e09b038d4d3c640f8
Valid from: Fri Mar 04 17:00:00 MST 2005 until: Sat Mar 19 16:59:59 MST 2005
Certificate fingerprints:
MD5: 29:F6:04:14:90:20:FC:80:FF:BB:A0:EE:A7:4A:81:F7
SHA1: C3:EC:12:C2:CC:CE:B1:F4:C4:6A:56:80:74:93:EC:A7:48:43:3C:7F
Certificate[2]:
Owner: OU=For VeriSign authorized testing only. No assurances (C)VS1997, OU=http://www.verisign.com/repository/TestCPS Incorp. By Ref. Liab. LTD., O="Ve
riSign, Inc"
Issuer: OU=For VeriSign authorized testing only. No assurances (C)VS1997, OU=http://www.verisign.com/repository/TestCPS Incorp. By Ref. Liab. LTD., O="V
eriSign, Inc"
Serial number: 52a9f424da674c9daf4f537852abef6e
Valid from: Sat Jun 06 18:00:00 MDT 1998 until: Tue Jun 06 17:59:59 MDT 2006
Certificate fingerprints:
MD5: 40:06:53:11:FD:B3:3E:88:0A:6F:7D:D1:4E:22:91:87
SHA1: 93:71:C9:EE:57:09:92:5D:0A:8E:FA:02:0B:E2:F5:E6:98:6C:60:DE
Alias name: verisigndemocert
Creation date: Mar 4, 2005
Entry type: trustedCertEntry
Owner: OU=For VeriSign authorized testing only. No assurances (C)VS1997, OU=http://www.verisign.com/repository/TestCPS Incorp. By Ref. Liab. LTD., O="Ve
riSign, Inc"
Issuer: OU=For VeriSign authorized testing only. No assurances (C)VS1997, OU=http://www.verisign.com/repository/TestCPS Incorp. By Ref. Liab. LTD., O="V
eriSign, Inc"
Serial number: 52a9f424da674c9daf4f537852abef6e
Valid from: Sat Jun 06 18:00:00 MDT 1998 until: Tue Jun 06 17:59:59 MDT 2006
Certificate fingerprints:
MD5: 40:06:53:11:FD:B3:3E:88:0A:6F:7D:D1:4E:22:91:87
SHA1: 93:71:C9:EE:57:09:92:5D:0A:8E:FA:02:0B:E2:F5:E6:98:6C:60:DE
That has a lot more information now! The most important thing you want to see is that, under the private key alias, additional information is being displayed. You're looking for this:
Certificate chain length: 2
This tells you that keystore was successful in establishing the certificate chain, and your keystore is ready for use. (Again, if I were using real production Verisign certificates, this value would be 3 instead of 2.)
SSL is one of the first things you can configure to secure your Web applications. Using Java's keytool, you can quickly build a usable keystore.