I created a root CA and intermediate CA, and then created a server CA certificate signed by the intermediate CA. The purpose of whole that is for a TLS one way encryption between a java thin client and a server.

Please find the commands below:

• bash$ openssl genrsa -out private/intermediate_key.pem ==> create private key for intermediate CA intermediate_key.pem
• bash$ openssl req -config openssl_intermediate.cnf -key private/intermediate_key.pem -new -sha256 -out certs/intermediate_csr.pem -subj "/C=FR/ST=Paris/L=Paris/O=COMP/OU=CH/CN=Intermediate CA" ==> create csr certificate intermediate_csr.pem
    ○ To read the csr certificate:  openssl req -in intermediate_csr.pem -noout -text
• bash$ openssl ca -config ../rootCA/openssl_root.cnf -extensions v3_intermediate_ca -days 3650 -notext -md sha256 -in certs/intermediate_csr.pem -out certs/intermediate_cert.pem ==> this will sign the certifitcate for the intermediate CA 
    ○ To read the certificate: bash$ openssl x509 -noout -text -in certs/intermediate_cert.pem
• bash$ cat certs/intermediate_cert.pem ../rootCA/certs/ca_cert.pem > certs/ca-chain_cert.pem ==> create certificate chain
• bash$ openssl genrsa -aes256 -out server_key.pem ==> create sever key with password mykey
• bash$ openssl req -config openssl_intermediate.cnf -key certs/server_key.pem -new -sha256 -out certs/server_csr.pem -subj "/C=FR/ST=Paris/L=Paris/O=COMP/OU=CH/CN=Server" ==> create csr for server 
• bash$ openssl x509 -req -in certs/server_csr.pem -CA certs/intermediate_cert.pem -CAkey private/intermediate_key.pem -out server_cert.pem -CAcreateserial -days 365 -sha256 -extfile server_cert_ext.cnf ==> create a certificate for the server with SAN defined in the config file passed

Now I want to create 2 keystores:

  1. keystore with the server certificate aka trustore on the client side
  2. keystore for the server with the private key of the server

Noting that the steps below I followed are mainly using openssl, for the 2 above steps what are the commands that I should run, and should I do some changes in the format of the certificates or the keys? (ex; from pem to pcks12 , etc..)

I found this command online : keytool -import -alias anAlias -file server_certificate.cer -keystore trust_store.jks but I am not sure if this command works for both importing a certificate and a key.


You must log in to answer this question.