Monday, February 6, 2012

Generating a CSR and Installing an SSL Certificate in Tomcat 4.x/5.x/6.x

This article owned by GoDaddy and you can find the original one via

When you request an SSL certificate, you must provide a Certificate Signing Request (CSR) from your server. The CSR includes your public key, and must contain the same details as the online request form in your account. After your request is vetted and your certificate is issued, download and install all of the provided files to complete the installation.
NOTE: These steps describe how to install a certificate using keytool, so you must have Java 2 SDK 1.2 or above installed on your server.

Generating a Keystore and CSR in Tomcat

Using Keytool, follow these steps to generate a keystore and CSR on your server.

To Generate a Keystore and CSR in Tomcat

  1. Enter the following command into keytool to create a keystore:
    keytool -keysize 2048 -genkey -alias tomcat -keyalg RSA -keystore tomcat.keystore
  2. Enter a Password. The default is changeit.
  3. Enter Distinguished Information:
    • First and Last Name — The fully-qualified domain name, or URL, you're securing. If you are requesting a Wildcard certificate, add an asterisk (*) to the left of the common name where you want the wildcard, for example*
    • Organizational Unit — Optional. If applicable, you can enter the DBA name in this field.
    • Organization — The full legal name of your organization. The listed organization must be the legal registrant of the domain name in the certificate request. If you are enrolling as an individual, please enter the certificate requestor's name in Organization, and the DBA (doing business as) name in Organizational Unit.
    • City/Locality — Name of the city in which your organization is registered/located — do not abbreviate.
    • State/Province — Name of state or province where your organization is located — do not abbreviate.
    • Country Code — The two-letter International Organization for Standardization (ISO) format country code for where your organization is legally registered.
  4. Enter the following command into keytool to create a CSR:
    keytool -certreq -keyalg RSA -alias tomcat -file csr.csr -keystore tomcat.keystore
  5. Enter the Password you provided in Step 2.
  6. Open the CSR file, and copy all of the text
  7. Paste all of the text into the online request form and complete your application.
For more information about completing the online request form, see Requesting a Standard SSL Certificate.
After you submit the application, we begin vetting your request. You will receive an email with more information when this process is complete.
OR Generating your self signed ssl certificates based on the csr created.  

Generating private keys (in the format of p12 and pem) which may be used by Google AppEngine:

1) keytool -importkeystore -srckeystore keystore.jks(Or your keystrore in other formats like .keystore) -destkeystore intermediate.p12 -deststoretype PKCS12
2) openssl pkcs12 -in intermediate.p12 -out extracted.pem –nodes

Installing Your SSL in Tomcat

After the certificate is issued, download it from the Certificate Manager and place it in the same folder as your keystore.
You can also download the intermediate certificates from therepository.

To Install Your SSL in Tomcat

Using keytool, enter the following commands to install the certificates.
  1. Install the Root certificate:
    keytool -import -alias root -keystore tomcat.keystore -trustcacerts -file valicert_class2_root.crt
  2. Install the first intermediate (gd_cross_intermediate.crt):
    keytool -import -alias cross -keystore tomcat.keystore -trustcacerts -file gd_cross_intermediate.crt
  3. Install the second intermediate (gd_intermediate.crt):
    keytool -import -alias intermed -keystore tomcat.keystore -trustcacerts -file gd_intermediate.crt
  4. Install the issued certificate:
    keytool -import -alias tomcat -keystore tomcat.keystore -trustcacerts -file <name of your certificate>
After importing the certificates into the keystore, you need to update the server.xml file in the Tomcat directory with the correct keystore location.
NOTE: The HTTPS connector is commented out by default. Remove the comment tags to enable HTTPS.
Tomcat 4.x — Update the following elements in server.xml for Tomcat 4.x:
<Factory className="org.apache.coyote.tomcat4.CoyoteServerSocketFactory"
protocol="TLS" keystoreFile="/etc/tomcat5/tomcat.keystore"
keystorePass="changeit" />
Tomcat 5.x, 6.x and 7.x — Update the following elements in server.xml for Tomcat 5.x, 6.x and 7.x:
<-- Define a SSL Coyote HTTP/1.1 Connector on port 8443 --> <!-- <Connector port="8443" maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
keystoreFile="path to your keystore file" keystorePass="changeit" clientAuth="false" sslProtocol="TLS"/>
After you save changes to server.xml, restart Tomcat to begin using your SSL.