Appendix: Set up Tomcat server by using a third-party (external) CA
Perform the tasks in the following sections to set up the Tomcat server by using an external CA.
Generate CA Private Key:
Generate a self-signed certificate for CA (by using the previously generated private key):
This generates the following files:
- The CA private key: ext-CA-privatekey.pem
- The CA self-signed cert: ext-CA-cert.pem
Copy the ext-CA-cert.pem file into the directory from which you execute keytool commands.
Generate a server key pair and self-signed certificate:
When prompted, enter the following information for the server certificate you want to generate and enter a new KeyStore password, which all subsequent keytool and jarsigner commands use:
Generate and export the CSR:
Enter the KeyStore password.
Send the CSR to the external CA previously created in OpenSSL, either third-party or internal, to get it signed.
The CA returns a signed server certificate and a root CA certificate.
Copy the tomcatserver.csr file in the directory from which you execute openssl commands.
Sign the CSR and generate the signed Tomcat server certificate:
This generates the signed Tomcat server cert: ssl-tomcatserver-cert.pem
Copy the ssl-tomcatserver-cert.pem file into the directory from which you execute keytool commands.
Run the following command to import the CA root certificate:
Enter the KeyStore password.
When prompted to trust the certificate, enter yes, as shown in the following example:
If the command succeeds, you see output similar to the following:
To import the signed server certificate, run the following command:
Enter the KeyStore password.
If the command succeeds, you should see an output similar to the following:
Go to the apache\conf\server.xml file and change KeyAlias to the alias user in the preceding step.
Start up Apache Server and go to apache\conf\bin\startup.
Open a web browser and go to https://localhost:8443.
The connection should show the certificate information.
The subject and issuer are different because this is not a self-signed certificate.