Please fill out the fields below so we can help you better.
My domain is: retok.ddns.net
I ran this command:
1 - Generate account.key WITH SUCCESS:
C:>c:\Programas\GnuWin32\bin\openssl.exe genrsa -out account.key 2048
Loading ‘screen’ into random state - done
Generating RSA private key, 2048 bit long modulus
…+++
…
…+++
e is 65537 (0x10001)
2 - Generate the Tomcat CSR file.
C:>keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore .keys
tore
Enter keystore password:
C:>
3 - Register account WITH SUCCESS:
C:>java -jar acme_client.jar -a c:\account.key --command register --with-agreem
ent-update --email amrbrodrigues@gmail.com
{“status”:“ok”}
4 - Authorize domain WITH SUCCESS
C:>java -jar acme_client.jar -a c:\account.key -w c:\ --command authorize-domai
ns -d retok.ddns.net --well-known-dir c:\wellknown --one-dir-for-well-known
{“status”:“ok”}
5 - Copy welknow file to: C:\Programas\Apache Software Foundation\Tomcat 8.0\webapps\ROOT.well-known\acme-challenge\
6 - Verify Domain WITH SUCCESS
C:>java -jar acme_client.jar -a c:\account.key -w c:\ --command verify-domains
-d retok.ddns.net
{“status”:“ok”}
7 - Generate certificate ERROR:
C:>java -jar acme_client.jar -a c:\account.key -w c:\ --command generate-certif
icate --csr c:\certreq.csr --cert-dir c:\wellknown
{“status”:“error”}
It produced this output: {“status”:“error”}
My operating system is (include version): Windows XP Version: 2002 SP2 using the acme_client.jar (Java API indicated in LetsEncript homepage)
My web server is (include version): Apache Tomcat 8.0
My hosting provider, if applicable, is: Router and communication is Vodafone, the server machine is mine (I believe not relevant to this problem)
I can login to a root shell on my machine (yes or no, or I don’t know): yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no
How could I solve this problem? Why the LetsEncript not accepting CSR files created according the tomcat documentation. Tomcat 8.0 documentation have the following to generate the certificate:
"Installing a Certificate from a Certificate Authority
To obtain and install a Certificate from a Certificate Authority (like verisign.com, thawte.com or trustcenter.de), read the previous section and then follow these instructions:
Create a local Certificate Signing Request (CSR)
In order to obtain a Certificate from the Certificate Authority of your choice you have to create a so called Certificate Signing Request (CSR). That CSR will be used by the Certificate Authority to create a Certificate that will identify your website as “secure”. To create a CSR follow these steps:
Create a local self-signed Certificate (as described in the previous section):
keytool -genkey -alias tomcat -keyalg RSA
-keystore <your_keystore_filename>
Note: In some cases you will have to enter the domain of your website (i.e. www.myside.org) in the field "first- and lastname" in order to create a working Certificate.
The CSR is then created with:
keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr
-keystore <your_keystore_filename>
Now you have a file called certreq.csr that you can submit to the Certificate Authority (look at the documentation of the Certificate Authority website on how to do this). In return you get a Certificate.
Importing the Certificate
Now that you have your Certificate you can import it into you local keystore. First of all you have to import a so called Chain Certificate or Root Certificate into your keystore. After that you can proceed with importing your Certificate.
Download a Chain Certificate from the Certificate Authority you obtained the Certificate from.
For Verisign.com commercial certificates go to: http://www.verisign.com/support/install/intermediate.html
For Verisign.com trial certificates go to: http://www.verisign.com/support/verisign-intermediate-ca/Trial_Secure_Server_Root/index.html
For Trustcenter.de go to: http://www.trustcenter.de/certservices/cacerts/en/en.htm#server
For Thawte.com go to: http://www.thawte.com/certs/trustmap.html
Import the Chain Certificate into your keystore
keytool -import -alias root -keystore <your_keystore_filename>
-trustcacerts -file <filename_of_the_chain_certificate>
And finally import your new Certificate
keytool -import -alias tomcat -keystore <your_keystore_filename>
-file <your_certificate_filename>
