Create a Java KeyStore
Secure connections in Curity rely on you storing a server private key and certificate in the Java KeyStore saved on the HSM. The system presents this server certificate to clients when they connect to the Tomcat server. Typically, you create the KeyStore by using the keytool application bundled with Java (usually located in $JAVA_HOME/jre/bin/).
Perform the following tasks to create a Java KeyStore:
- Generate a server key pair and self-signed certificate.
- Generate and export a CSR.
- Import a CA root certificate.
- Import the server certificate signed by the CA.
Because the JDK 17 installation includes keytool, you can run the commands without additional configuration.
The following sections show how to perform these tasks:
Execute the following command:
-alias sets a name to identify the key pair and certificate to be generated. It can be any name (for example, CurityDemo). You use this name when configuring the key in Curity.
When prompted, enter the following information for the server certificate you want to generate and provide a new KeyStore password, which all subsequent keytool and jarsigner commands:
To generate and export a CSR, run the following command:
Enter the KeyStore password.
Send the CSR to a third-party or internal CA to get it signed.
The CA returns the server certificate and CA certificate for you to import.
To import the CA root certificate, run the following command:
Enter the KeyStore password.
When prompted to trust the certificate, enter Yes as shown in the following example:
To import the signed server certificate, run the following command:
Enter the KeyStore password.
If the command was successful, you should see an output similar to the following example: