Use this file to discover all available pages before exploring further.
The Tomcat secure connections rely on you storing a server private key and certificate in the Java KeyStore saved on the HSM. The system presents this server certificate to clients when they connect to the Tomcat server.Typically, you create the KeyStore by using the keytool application bundled with Java (located in $JAVA_HOME/jre/bin/). The following sections outline these tasks:
Generate a server key pair (which includes a self-signed certificate to be stored in the HSM)
Generate and export a CSR to be signed by an external CA (if needed)
Import the external CA root certificate
Import server certificate signed by the external CA
To test that you created the self-signed certificate in the HSM and that the Tomcat server is presenting it to client connections, execute the Generate a server key pair and self-signed certificate section and then move on to server configuration.
If you need a connection using an external CA, go to Generate and export CSR, sign the CSR by using an external CA authority (which you can create with OpenSSL), and finally proceed with the Import CA root certificate and Import Server Certificate Signed by CA sections.
Perform the following steps to generate a server key pair and self-signed certificate:
1
Execute the following command:
-alias sets a name to identify the key pair and certificate to be generated. It can be any name (such as tomcatdemo1), but you must use the same name in the next section, Configure Tomcat and test the server.
When prompted, enter the following information for the server certificate you want to generate and enter a new KeyStore password. Be sure to save this password, which all subsequent keytool and jarsigner commands use:
None
What is your first and last name?[Unknown]: www.example.comWhat is the name of your organizational unit?[Unknown]: EngineeringWhat is the name of your organization?[Unknown]: FuturexWhat is the name of your City or Locality?[Unknown]: BulverdeWhat is the name of your State or Province?[Unknown]: TXWhat is the two-letter country code for this unit?[Unknown]: USIs CN=www.example.com, OU=Engineering, O=Futurex, L=Bulverde, ST=TX, C=US correct?[no]: yes
The previous command generates a self-signed certificate. If you need a CA-signed certificate, continue with the remaining steps. Otherwise, proceed to server configuration.
