I'm trying to setup a keychain on Apache Tomcat that contains a server certificate that was signed by a custom root ca certificate. (not sure if custom is the right word here, but it's a root certificate that I created myself and that I want to trust). The idea behind this is that all certificates signed by this CA should be considered trusted.
Here's the steps I did
Create the root certificate (that I will trust in my keychain)
openssl req -new -x509 -sha512 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 365 -config ./openssl.cnf
Create a server key and a certificate signing request
openssl req -new -nodes -sha512 -out name-req.pem -keyout private/name-key.pem -days 365 -config ./openssl.cnf
Sign the request with the CA created in step 1 and generate a certificate
openssl ca -out name-cert.pem -days 365 -config ./openssl.cnf -infiles name-req.pem
Create the PKCS12 file
openssl pkcs12 -sha512 -export -in name-cert.pem -inkey private/name-key.pem -certfile cacert.pem -name "[friendly name]" -out name-cert.p12
Setup a PKCS12 keystore for Tomcat
openssl pkcs12 -export -in name-cert.pem -inkey private/name-key.pem -out mycert.p12 -name tomcat -CAfile cacert.pem -caname root -chain
I've installed the keystore in tomcat correctly and I can access the HTTPS connector
I installed the CA certificate in my keychain where it is marked as trusted for all users.
However, when I access the page using a browser (Firefox / Safari) I'm still seeing this:
Why is it that this certificate (issued by "CA", and "CA" being a certificate marked as trusted for all users) is still throwing an error ?