JKS have been causing people a few headaches so I thought I would write a guide on this
A) Talk about JKS, keytool and KeyStore Explorer
B) Create a JKS - letsencrypt.jks with a RSA 2048 key (simple-cert)
C) Add a second RSA 4096 key - (san-cert)
D) Create a CSR for simple-cert and a CSR for san-cert
E) Complete Challenges with Certbot
F) Add certificates to KeyStore and Verify
G) Add To Tomacat 8.x and Verifying Certificate and JKS Functioning
H) Converting Standard certbot artifacts to a JKS (thanks to @sahsanu)
I) Creating JKS files with Bash and OpenSSL
J) Using pyjks for creating JKS files with Hooks
K) Dealing with Intermediates and Roots - options and ground work
Hope this helps out and clarifies some things out.
JKS is tricky as a format as keys can’t exist without certificates. This can be confusing but it’s fairly simple to deal with.
A JKS can also have multiple keys and certificates and these are known as keypairs.
keytool is a java command line utility for working with JKS and is available with the Java Development Kit (JDK) or Java Runtime Environment (JRE). First order of business is to confirm the keytool is available.
Create a JKS - letsencrypt.jks with a RSA 2048 key
Creating a JKS from scratch adds several advantages when generating certificates as it can simplify things for us.
As mentioned previously a key must have a certificate associated with it so we are going to have to provide a domain name with the generation of the key.
We are going to create JKS with the following parameters
Key Store Name: letsencrypt.jks Key Store Password: test12345 Key Name (alias): simple-cert Domain Name: jks-simple-cert.firecube.xyz Web Private Key: RSA 2048
Note: this is not a required step for most installs however to understand JKS functionality fully and the purpose of aliases it's good to have two keys (and refer to them in the tomcat config)
We are going to use the manual plugin with DNS challenges and CSRs we created above
I am using a virtual environment (Certbot-Production for this)
Note: you should use --staging flag for learning and practice. Once you can issue certificates reliably from the staging authority and remove --staging and obtain production certificates.
If we run the commands again we will not get warnings as the intermediate is in the keystore.
Note: even though the intermediates are in the certificate files they are not trusted by the keystore until the intermediate certificate is in the store.
Below is a sample configuration of two ports using the same JKS and then different aliases to ports (8443 and 8444). This is one of the nicer aspects of JKS files.
You can also store historic certificates within the JKS.
