Skip to main content
Perform the tasks in the following sections to set up the Tomcat server by using an external CA.

​
OpenSSL: Create an external CA

Perform the following steps to use OpenSSL to create an External CA:
1
Generate CA Private Key:
Shell
2
Generate a self-signed certificate for CA (by using the previously generated private key):
Shell
This generates the following files:
  • The CA private key: ext-CA-privatekey.pem
  • The CA self-signed cert: ext-CA-cert.pem
3
Copy the ext-CA-cert.pem file into the directory from which you execute keytool commands.

​
Java KeyTool: Generate a CSR for an external CA

Perform the following steps to use Java KeyTool to generate a CSR for an external CA:
1
Generate a server key pair and self-signed certificate:
Shell
2
When prompted, enter the following information for the server certificate you want to generate and enter a new KeyStore password, which all subsequent keytool and jarsigner commands use:
None

​
Java KeyTool: Generate and export a CSR

Perform the following steps to use JavaKeyTool to generate and export a CSR:
1
Generate and export the CSR:
Javascript
2
Enter the KeyStore password.
3
Send the CSR to the external CA previously created in OpenSSL, either third-party or internal, to get it signed.
The CA returns a signed server certificate and a root CA certificate.
4
Copy the tomcatserver.csr file in the directory from which you execute openssl commands.

​
OpenSSL: Sign the Tomcat server CSR

Perform the following steps to use OpenSSL to sign the Tomcat server CSR:
1
Sign the CSR and generate the signed Tomcat server certificate:
Shell
This generates the signed Tomcat server cert: ssl-tomcatserver-cert.pem
2
Copy the ssl-tomcatserver-cert.pem file into the directory from which you execute keytool commands.

​
Java KeyTool: Import the CA root certificate

Perform the following steps to use Java KeyTool to import the CA root certificate:
1
Run the following command to import the CA root certificate:
Shell
2
Enter the KeyStore password.
3
When prompted to trust the certificate, enter yes, as shown in the following example:
Shell
If the command succeeds, you see output similar to the following:
Shell

​
Java KeyTool: Import the signed server certificate

Perform the following steps to use Java KeyTool to import the signed server certificate:
1
To import the signed server certificate, run the following command:
Shell
2
Enter the KeyStore password.
If the command succeeds, you should see an output similar to the following:
Shell

​
Test Apache Tomcat

Perform the following steps to test Apache Tomcat:
1
Go to the apache\conf\server.xml file and change KeyAlias to the alias user in the preceding step.
2
Start up Apache Server and go to apache\conf\bin\startup.
3
Open a web browser and go to https://localhost:8443.
The connection should show the certificate information.The subject and issuer are different because this is not a self-signed certificate.