1

I have taken a working HTTPS certificate from a server that I want to use on the same server, just on a different port. The certificate has a Subject Alternative Name defined in it. Using keytool, I generated a new keystore, added the existing certificate, and restarted Tomcat. However, when I get to the site, it still says that it is insecure. The errors say the certificate has no SAN, and it looks like the certificate is now listed as self-signed. Any idea why this is happening and how to get a secure, valid https connection?

EDIT:

These are the commands I ran:

generating keystore:

    keytool -genkey -alias myalias -keyalg RSA -keystore "C:\Program 
    Files\Apache Software Foundation\Tomcat 9.0\conf\Keystore\keystore"

importing signed certificate

keytool -importcert -file certfromgissite.cer -keystore keystore

So after those two commands are run, my keystore has the privateKeyEntry and the trustedCertEntry.

Improve this question
1
  • 4
    A certificate is independent from the port so it should work if properly done. It is likely that you did something wrong when installing the certificate or trying to test the issue. Only it is not fully clear what you actually did and thus not clear what you did wrong.
    – Steffen Ullrich
    Commented Oct 1, 2019 at 21:38

2 Answers 2

Reset to default
2

I figured out the issue. The problem was not with the CA key, it was with the private key. Once i remade the private key using this:

keytool -genkey -alias gis.akrf.com -keyalg RSA -keystore "C:\Program Files\Apache Software Foundation\Tomcat 9.0\conf\Keystore\keystore" -ext SAN=dns:(your dns here, like some.domain.com or localhost, which should also match your keyalias in tomcat's server.xml )

so it has an SAN and followed the directions here, it worked.

Improve this answer
1
  • Did you requested new certificate or used a self-signed one?
    – nethero
    Commented Oct 7, 2019 at 5:42
0

You have the keystore and the truststore. The truststore is where you store CA's you trust, the issuer CA must be added to the truststore. The keystore is where you store the key. Does your keystore contain both private key and the certificate? Your connector must point to both the keystore and the truststore. If you are working on the same Tomcat server you can simply change port value in the connector settings.

Improve this answer
3
  • Yes, my keystore contains both the private key and the certificate. Are you saying that two programs can run on the same port simultaneously?
    – user218781
    Commented Oct 2, 2019 at 13:53
  • What is the syntax to add an actual CA to the truststore? I saw documentation on adding the actual certificate, but not the CA. I added the CA to the trusted root authorities (this is on a windows server)
    – user218781
    Commented Oct 2, 2019 at 14:21
  • I tried changing the connector port to the one currently being used, but I got a 404 error. Probably because the original application does not use tomcat; it's deployed through IIS. I would most likely need to install geoserver on that directory and I'd rather keep it separate
    – user218781
    Commented Oct 2, 2019 at 14:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .