Steps for Enabling SSL: The following steps will help you in the installation of SSL certificate in
Steps for Enabling SSL: The following steps will help you in the installation of SSL certificate in : Step 1: Startup Process : Step 2: Certificate Request Process : 1: Start.(Start --> All Programs --> --> Start ). 2: Change the Port Settings from http to https.("admin" tab --> "Connection" (left pane) --> Check "Enable SSL Port [https]" --> Save). 3: Stop.(Start --> All Programs --> --> Stop ). 4: Create tomcat specific ".keystore" file and ".csr" file, which will be further referred as and <domainname>.csr respectively. 5: To create the certificate keystore file from <installation directory> \ jre \bin, Execute the following command in the command prompt : keytool -genkey -alias tomcat -keypass <your key password> -keyalg RSA -validity 1000 -keystore What is the First and Last Name : The NetBIOS or FQDN name of the server in which is running. What is the name of your Organizational Unit : The OU name which you want can be specified. What is the name of your Organization : Provide the legal name of your organization What is the name of your City : Enter the city name as provided in your organization's registered address What is the name of your tate/province : Enter the tate/province as provided in your organization's registered address What is the name of your Country Code : Provide the 2-letter code of the country your organization is located in. Password : Enter a password of at least 6 characters Note: At the end of executing the above command, you will be prompted to enter keystore password. Try giving the same password as your key password. 6. To create a csr(certificate Signing Request) file from the <installation directory> \ jre \ bin, Execute the following command in the command prompt : keytool -certreq -alias tomcat -keyalg RSA -keystore -file <domainname>.csr Page: 1
Step 3: Certificate Issuance Process : Request for certificate from Microsoft Certificate Services (internal CA): 1: Connect to Microsoft Certificate ervices and click on "Request a certificate" link. 2. Click on "advanced certificate request" Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file. 3. Copy the content of the ".csr" file and paste it under "Saved Request", select "Web Server" as "Certificate Template" and click on "Submit" button. Note: Open the ".csr" file using an editor, copy the content and paste it under "Saved Request". Page: 2
4. The certificate will be issued and click on "Download certificate chain" link to download "PKCS #7 Certificates" types. Note: Copy and paste the certificate file under "<installation dir.\jre\bin" folder 5. Click on the "Home" link on the top right hand side corner and click on "Download a CA certificate, chain certificate or CRL" link to download the CA root certificate. Click on "Download CA certificate" link and save the root certificate. 6.Browse to "<installation dir.\jre\bin" location using command prompt to import the internal CA certificate into ".keystore" file. Execute the below query to import the certificate into ".keystore" file Keytool import trustcacerts alias tomcat file certnew.p7b keystore <keystore_name >.keystore 7. Add your internal CA's root certificate to the list of trusted CAs in the Java cacerts file. Execute the below provided query to add the root certificate into trusted CA list of Java file. keytool -import -alias <internal CA_name> -keystore..\lib\security\cacerts -file certnew.cer Note: Open the "certnew.cer" to get the internal CA name and provide the password as "changeit" when it is prompted. Page: 3
Step 4 :Associating the Certificate with : 1. Copy the ".keystore" file from "<installation dir.>\jre\bin" folder to "<installation dir.>\conf" folder. 2. Take a back up copy of "server.xml" file as "server.xml_bak" and edit the file. 3. Replace the value of "keystorefile" to "./conf/<keystore_name>.keystore" at the last Connector tag (End of the page). 4. Replace the password for "keystorepass" to "password as given while creating keystore" 5. Save the server.xml file and start. 6. Now try accessing the application. Request for certificate from External CA. Submit the CSR file to your Certifying Authority (CA) 1. Unzip the certificates returned by your CA and put them in <install_dir>/jre/bin folder 2. Open the command prompt and navigate to <install_dir>/jre/bin folder 3. Now, run the respective commands from the below list as applicable to your CA: For "GoDaddy" certificates i. keytool -import -alias root -keystore -trustcacerts -file gd_bundle.crt ii. keytool -import -alias cross -keystore -trustcacerts -file gd_cross.crt iii. keytool -import -alias intermed -keystore -trustcacerts -file gd_intermed.crt iv. keytool -import -alias tomcat -keystore -trustcacerts -file selfservice.crt For "Verisign" certificates i. keytool -import -alias intermediateca -keystore -trustcacerts -file < your intermediate certificate.cer> ii. keytool -import -alias tomcat -keystore -trustcacerts -file admanager.cer For "Comodo" certificates i. keytool -import -trustcacerts -alias root -file AddTrustExternalCARoot.crt -keystore ii. keytool -import -trustcacerts -alias addtrust -file UTNAddTrustServerCA.crt -keystore Page: 4
domainname>.keystore iii. keytool -import -trustcacerts -alias ComodoUTNServer -file ComodoUTNServerCA.crt - keystore iv. keytool -import -trustcacerts -alias essentialssl -file essentialsslca.crt -keystore For "Entrust" certificates i. keytool -import -alias Entrust_L1C -keystore <keystore-name.keystore> -trustcacerts -file entrust_root.cer ii. keytool -import -alias Entrust_2048_chain -keystore <keystore-name.keystore> - trustcacerts -file entrust_2048_ssl.cer iii. keytool -import -alias -keystore <keystore-name.keystore> -trustcacerts -file <domain-name.cer> For "Thawte" certificates Purchased directly from Thawte i. keytool -import -trustcacerts -alias tomcat -file <certificate-name.p7b> -keystore <keystore-name.keystore> Purchased through the "Thawte reseller" channel: i. keytool -import -trustcacerts -alias thawteca -file <SSL_PrimaryCA.cer> -keystore <keystore-name.keystore> ii. keytool -import -trustcacerts -alias thawtecasec -file <SSL_SecondaryCA.cer> - keystore <keystore-name.keystore> iii. keytool -import -trustcacerts -alias tomcat -file <certificate-name.cer> -keystore <keystore-name.keystore> Note: If you are receiving the certificates from a CA who is not in the list provided above, then contact your CA to get the commands required to add their certificates to the keystore. Bind the certificates with 1:This will configure the server to use the keystore with your SSL certificate. SSL port [https] option 2. Enter port number (default: 8443) you plan on using for SSL connection, click Save, and restart. 3. Now, copy the file from <install_dir>\jre\bin folder and paste it in <install_dir>\conf folder 4. Open 'server.xml' file located at <install_dir>\conf folder 5. eplace the value of keystorefile with './conf/' and keystorepass with the password that you used in Step 1 (last Connector tag at the End of page) 6. Save 'server.xml' file and close it 7. Restart again for the changes to take effect. support@fileauditplus.com www.fileauditplus.com