Hi Andrei,
Thanks a lot for the tips, it works almost everything fine.
I make the folowing commands and copy the keystore to the tomcat
configuration and it works fine:
1 - Convert the openssl certificate to PKCS12
C:>c:\Programas\GnuWin32\bin\openssl.exe pkcs12 -export -in
c:/wellknown/cert.pem -inkey retok.ddns.net.key -out server.p12
Loading ‘screen’ into random state - done
Enter Export Password:
Verifying - Enter Export Password:
2 - Convert a PKCS12 to java keystore format
C:>keytool -importkeystore -deststorepass -destkeypass
-destkeystore server.keystore -srckeystore server.p12 -srcstoretype PKCS12
-srcstorepass
Entry for alias 1 successfully imported.
Import command completed: 1 entries successfully imported, 0 entries
failed or
cancelled
3 - Import fullchain to the certificate
C:>keytool -import -alias root -keystore server.keystore -trustcacerts
-file c:/wellknown/fullchain.pem
Enter keystore password:
Certificate already exists in keystore under alias <1>
Do you still want to add it? [no]: y
Certificate was added to keystore
4 - Imports the chain to the certificate
C:>keytool -import -alias tomcat -keystore server.keystore -trustcacerts
-file c:/wellknown/chain.pem
Enter keystore password:
Certificate was added to keystore
Problems I had to make this conversion:
1 - If I used the openssl as described in the stackoverflow forum not
worked:
C:>c:\Programas\GnuWin32\bin\openssl.exe pkcs12 -export -in
c:/wellknown/cert.p
em -inkey retok.ddns.net.key -out server.p12 -name tomcat -CAfile ca.cert
-canam
e root
Loading ‘screen’ into random state - done
Enter Export Password:
Verifying - Enter Export Password:
6560:error:0D0BA041:asn1 encoding routines:ASN1_STRING_set:malloc
failure:./cryp
to/asn1/asn1_lib.c:381:
6560:error:0B08A041:x509 certificate routines:X509_ATTRIBUTE_set1_data:malloc
fa
ilure:./crypto/x509/x509_att.c:317:
2 - If I used the keytool as described in the stackoverflow forum not
worked:
C:>keytool -importkeystore -deststorepass arjavaretok -destkeypass
arjavaretok
-destkeystore server.keystore -srckeystore server.p12 -srcstoretype PKCS12
-srcs
torepass arjavaretok -alias tomcat
keytool error: java.lang.Exception: Alias does not exist
However there are some questions I have after make this:
1 - I check the keystore and discover the cert.pem and fullchain.pem are
the same certificate (the fullchain have the cert and chain inside). When I
tried to import to the keystore it indicate “Certificate already exists”. I
really need to import the fullchain Lets Encript file to my certificate?
2 - Even not converting the certificate to PKCS12 using the openssl, I
check and using the fullchain.pem file keytool imports OK to JKS file
format.
The manual of tomcat says to import the Chain Certificate and new
certificate to keystore (see my initial question, I have the manual
extraction from tomcat). If I make the import of the fullchain.pem works
OK, when I try to make the import of cert.pem it returns a error I sent in
my last email. Why I need to import the cert.pem if cert and chain is
already in the fullchain.pem file and it loads fine with keytool without
using any convertion to PKCS12?
Thank you again for your support.
Best regards
António Rodrigues