• Prerequisites
• Java keystores
  • PKCS7
  • PEM
  • PKCS12
• APR-based installation
• Apply the changes
• Troubleshooting
  • View keystore content
  • Extract Private key from keystore
  • Proprietary keystore format warning

Prerequisites

Java keystores

PKCS#7

Step 1: Upload SSL files

Upload the PKCS#7 certificate file on the server. Then, import it using the following command:

keytool -import -trustcacerts -alias tomcat -file certificate.p7b -keystore yourkeystore.jks

Where:

• tomcat is the actual alias of your keystore
• certificate.p7b is the actual name/path to your certificate file
• yourkeystore.jks is the actual name/path to the keystore file

Make sure the certificate file has the same alias used for creating the keystore. Otherwise, the â$œInput not an X.509 certificateâ$ error may take place.

After you have imported successfully, you should receive the following output:

Certificate reply was installed in keystore

Step 2: Edit SSL Configuration

In the next step, you will need to modify the connector for the default port 8443 or 443.

The modification should be done in the â$˜Tomcat installation directoryâ$™/conf/server.xml file. You can find the location of the directory containing the server.xml configuration file by issuing this command:

sudo find / -ipath '*tomcat*server.xml'

It will most likely be in /opt/tomcat/conf/server.xml or /etc/tomcat/server.xml

Here is an example of a JSSE connector for port 443 using the HTTP/1.1 protocol with TLS up to 1.3 enabled:

Where:

• /opt/tomcat/ssl/yourkeystore.jks is the absolute path and actual name of the keystore file
• keystore_password is the actual password for your keystore

Step 3: Apply changes

Once done, please restart Tomcat in order to apply the changes. If you are not quite sure about the steps to reproduce, feel free to jump to this section to apply the changes and verify SSL installation.

PEM

The most challenging, yet still common, way of installing an SSL certificate on Tomcat is by using separate PEM-formatted SSL certificates.

Step 1: Prepare the files

This method requires you to have each of the certificates saved in separate files:

1. CA root certificate.
2. CA second intermediate certificate (optional and can be omitted if your CA bundle contains only 1 intermediate certificate).
3. CA intermediate certificate.
4. End-entity certificate for your domain.

The order of the certificate will be as follows for the most frequently used PositiveSSL certificate:

Note: You can find more CA Bundles here.

Note: The â$œAAA Certificate Servicesâ$ is only installed if you chose the CA Bundle containing the cross-signed certificate.

The above list is composed in reverse order on purpose as this is the exact order in which the certificates should be imported to the keystore. You can download the certificate files from your Namecheap account along with the CA bundle. Here is the dedicated page with download links if you only need the CA bundle. It may come in handy if you encounter the â$œkeytool error: java.langException: Failed to establish chain from replyâ$ error.

Step 2: Import the files

Follow the below steps in the given order to import the files properly.

Import the root certificate by running:

keytool -import -trustcacerts -alias root -file root.crt -keystore yourkeystore.jks

Where:

• root is the alias of the imported CA root certificate
• root.crt is the actual name/path of your CA root certificate
• yourkeystore.jks is the actual name/path of the keystore file

Note: During import of the CA root certificate, you may be prompted with the following message.

Certificate already exists in system-wide CA keystore under alias
Do you still want to add it to your own keystore? [no]:

Disregard the warning and confirm certificate import with submitting y.

Import the second intermediate certificate:

keytool -import -trustcacerts -alias intermediate2 -file intermediate_2.crt -keystore yourkeystore.jks

Where:

• intermediate2 is the alias of the imported second intermediate CA certificate
• intermediate_2.crt is the actual name/path of your second intermediate CA certificate

Import the first intermediate certificate:

keytool -import -trustcacerts -alias intermediate1 -file intermediate_1.crt -keystore yourkeystore.jks

Where:

• intermediate1 is the alias of the imported first intermediate CA certificate
• intermediate_1.crt is the actual actual name/path of your first intermediate CA certificate

After the successful import of each of the above certificates, you should receive the following output:

Certificate was added to keystore

Import the end-entity certificate for your domain:

keytool -import -trustcacerts -alias tomcat -file certificate.crt -keystore yourkeystore.jks

Where:

• tomcat is the actual alias of your keystore. The alias for your end-entity certificate should be the same as the one you used when creating the keystore with the Private key. If you did not specify the alias during the keystore creation, the default value will be mykey.
• certificate.crt is the actual actual name/path of your end-entity certificate file.

After import of the end-entity certificate, the below message will be prompted:

Certificate reply was installed in keystore

Step 3: Edit the connector

In the next step, you will need to modify the connector for the default port 8443 or 443.

The modification should be done in the â$˜Tomcat installation directoryâ$™/conf/server.xml file. You can find the location of the directory containing the server.xml configuration file by issuing the below command:

sudo find / -ipath '*tomcat*server.xml'

Most likely, it will be in /opt/tomcat/conf/server.xml or /etc/tomcat/server.xml

Here is an example of the JSSE connector for port 443 using HTTP/1.1 protocol along with TLS up to 1.3 protocol versions: