Create a Java KeyStore
The Tomcat secure connections rely on you storing a server private key and certificate in the Java KeyStore saved on the HSM. The system presents this server certificate to clients when they connect to the Tomcat server.
Typically, you create the KeyStore by using the keytool application bundled with Java (located in $JAVA_HOME/jre/bin/). The following sections outline these tasks:
- Generate a server key pair (which includes a self-signed certificate to be stored in the HSM)
- Generate and export a CSR to be signed by an external CA (if needed)
- Import the external CA root certificate
- Import server certificate signed by the external CA
To test that you created the self-signed certificate in the HSM and that the Tomcat server is presenting it to client connections, execute the Generate a server key pair and self-signed certificate section and then move on to server configuration.
If you need a connection using an external CA, go to Generate and export CSR, sign the CSR by using an external CA authority (which you can create with OpenSSL), and finally proceed with the Import CA root certificate and Import Server Certificate Signed by CA sections.
Execute the following command:
-alias sets a name to identify the key pair and certificate to be generated. It can be any name (such as tomcatdemo1), but you must use the same name in the next section, Configure Tomcat and test the server.
When prompted, enter the following information for the server certificate you want to generate and enter a new KeyStore password. Be sure to save this password, which all subsequent keytool and jarsigner commands use:
The previous command generates a self-signed certificate. If you need a CA-signed certificate, continue with the remaining steps. Otherwise, proceed to server configuration.
To generate and export a CSR, run the following command:
Enter the KeyStore password.
Send the CSR to a CA, either third-party or internal, to be signed.
You should get a signed server certificate and a root CA certificate back.
To import the CA root certificate, run the following command:
Enter the KeyStore password.
When prompted to trust the certificate, enter yes as shown in the following example:
To import the signed server certificate, run the following command:
Enter the KeyStore password.
If the command succeeds, you should see an output similar to the following: