Hello Everyone, Welcome to another blog on PKI404 about ECC CSR Generation with openssl. So let's start without any further due.

ECC CSR GENERATION WITH OPENSSL

First Step is to check curves and select as per your usage

prime256v1 is fine

Now Follow the below steps.

if you have apache server installed then you may go to Apache/bin and use openssl tool else download from below Link

Download openssl - https://www.openssl.org/source/

Once download open in command prompt in administrator and go to openssl/bin and run below command

1.     At the prompt, type the following command to generate an ECC private key using the OpenSSL ecparam tool to generate your .key file:

openssl ecparam -out server.key -name prime256v1 -genkey

Where server is the name of your server.

Note: Recommended ECC key size is 256-bit. If greater encryption strength is required, your other private key option is secp384r1.

2.     Save (backup) the generated .key file, making sure to note its location. This private key is required later for ECC SSL Certificate installation.

3.     Next, type the following command to generate a ECC certificate signing request (CSR):

For Linux

openssl req -new -key server.key -out server.csr -sha256

for winodows run in openssl bin folder with below command

openssl req -new -key server.key -out server.csr -sha256 -config openssl.cnf

Make Sure you copy openssl.cnf file from openssl directory to its bin folder in windows only.

Where server is the name of your server.

4.     As you are prompted, enter the following information:

For fields that are not required, you can enter '.' and those fields will be left blank.

Country Name (2 letter code) [AU]:  IN

Type the two letter code for the country where your company is legally located.

State or Province Name (full name) [Some-State]: Delhi

Type the name of the state or providence where your company is legally located.

Locality Name (eg, city) [ ]: New Delhi

Type the name of the city where your company is legally located.

Organization Name (eg, company) [PKI404 Pvt Ltd]: PKI404

Type your company's legally registered name.

Organizational Unit Name (eg, section) [ ]: IT

Type the name of the department within your organization that you want to appear on the ECC SSL Certificate.
Common Name (e.g. server FQDN) [ ]: www.pki404.com or *.pki404.com

Type the fully qualified domain name (i.e. www.example.com) for the site that you are securing.
Note: If you are generating CSR for a Wildcard SSL Certificate, your common name should start with an asterisk (e.g., *.example.com).

6.     Now, open the .csr file with a text editor and copy the text of your CSR, including the -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST----- tags, and paste it into order form.    This is how your csr file looks.

-----BEGIN CERTIFICATE REQUEST-----MIICrTCCAZUCAQAwaDELMAkGA1UEBhMCSU4xDjAMBgNVBAgMBURlbGhpMRIwEAYD
VQQHDAlOZXcgRGVsaGkxEDAOBgNVBAoMB1BLSSA0MDQxCzAJBgNVBAsMAkNBMRYw
FAYDVQQDDA1QS0kgNDA0IFN1YkNBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA+JiR6HoSazhUkeAye2TvVkQ/xOt+SmKvDizf47RI9oW3aeYNQKP4UGm3
FCa9JRuLoNyY72DSlXm0L3u7VUbvUQGF+sKkLV+dG80/r5M5UjZ2odQCQLi18Nt9
ilSwgVIFQjEZCMa+d4ts8vvUFfmbkBaM+Ce5Cu8mtQqcc8VcFnvPOTu8KCrJMrzh
U5cOIS05BpJnMae7lYxSK3zdDoecDH1VYV9vsKzyfqicOXVzm1tkw9WpDHLTvxQu
GgE9Gm7AIZitRmbTPh9cUZKbKqVNrh+8gmjx3LSk3p6JiHzJicqALRirowN9x6ot
iUxN+rkUsMc0LJ+a5bFHjBQ9PegbxwIDAQABoAAwDQYJKoZIhvcNAQELBQADggEB
AFw+Dtg/o8QGVusabLHAQ+3BK6SLWOXNN2od0LIyR3r4GgRwGnMzm1U7cyivKhp+
zyZi4kHO7d1V5Jhf3ICrtbKm41ci3f2UpIfoa3mPMw1h9SUc425m2oODNMCNbtpw
XkLp0VPpo12q6EkkYTwsxbUpX7yopmXx+GS5RQorw8O6YtjX0Hsuv1q210PHoTt+
0srpkeb51nHUhHMTOFgtsre9b+iG2jW0T6MX+W8ebTZPFERIkKqENayaCl7Xl98C
kxIWljG99gwjm+UqJrnFZfXlgO2BZbeov1yIZUE9UC1ntGwodxTXLwKjXLLgNFUk
a0GiMRo+C+Vm/uj12Grw894=
-----END CERTIFICATE REQUEST----- 

Check csr content

For linux

openssl req -in  serverecc.csr -noout -text

for windows

openssl req -in  serverecc.csr -noout -text -config openssl.cnf

output in windows

 Hello Everyone!! Welcome to another exciting article by PKI404, In this article we will see most common command used in openssl for pfx and key files on apache and iis web servers , keytool for java based servers like jboss, tomcat etc , sapgenpse for sap servers , orapki for oracle wallet manager. So lets start without any further due.

Most common commands for openssl keytool sapgenpse orapki

Most Common Openssl Commands

To Generate CSR and Private key

openssl req -new -newkey rsa:2048 -sha256 -nodes -out domainname.csr -keyout privatekey.key

Convert PEM to DER:

openssl x509 -outform der -in certificate.pem -out certificate.der

Convert DER to PEM:

openssl x509 -inform der -in certificate.der -out certificate.pem

Convert PEM/CRT to P7B:

openssl crl2pkcs7 -nocrl -certfile certificate.crt -out certificate.p7b -certfile CACert.crt

Convert P7B to PEM/CRT:

openssl pkcs7 -print_certs -in certificate.p7b -out certificate.crt

Convert PEM/CRT & Private Key to PFX/P12:

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt

 Convert P7B to PFX: (first convert p7b to pem/crt from above commands then use below)

 openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx -certfile CACert.cer

 Convert PFX to PEM/CRT and Private Key

openssl pkcs12 -in certificate.pfx -out certificate.pem -nodes 

OpenSSL command to remove private key password

                                          Or 

To convert simple private to  RSA  private.key

openssl rsa -in file.key -out newfile.key

Create RSA Private Key from PFX (private key without any password)

openssl pkcs12 -in certificate.pfx -nocerts -nodes | openssl rsa -out newrsaprivatekey.key

To View CSR contents

openssl req -in mycsr.csr -noout -text

To view Certificate X509 contents (.cer/,crt/.pem files)

openssl x509 -in certificate.crt -text -noout

To Match private key, CSR and certificate (output of all three commands should be the same)

openssl pkey -in privateKey.key -pubout -outform pem | sha256sum

openssl x509 -in domaincertificate.cer -pubkey -noout -outform pem | sha256sum

openssl req -in CSR.csr -pubkey -noout -outform pem | sha256sum

openssl command print out md5 checksums of the certificate and key

openssl x509 -noout -modulus -in server.cer| openssl md5

openssl rsa -noout -modulus -in server.key| openssl md5

Most Common Java Keytool Commands

Generate a Java keystore and key pair:

keytool -genkey -alias mydomainname -keyalg RSA -keystore keystorefilename.jks -keysize 2048

Generate a certificate signing request (CSR) for an existing Java keystore: 

keytool -certreq -alias mydomainname -keystore keystorefilename.jks -file mydomainname.csr

Generate a keystore and self-signed certificate:

keytool -genkey -keyalg RSA -alias selfsigned -keystore keystorefilename.jks -storepass password -validity 360 -keysize 2048

Certificate import commands in keystore: (.crt and .cer is same even .pem can be used)

Import a root CA certificate to an existing Java keystore:

keytool -import -trustcacerts -alias root -file root.cer -keystore keystorefilename.jks

Import a intermediate CA certificate to an existing Java keystore:

keytool -import -trustcacerts -alias intermediate -file intermediate.crt -keystore keystorefilename.jks

Import a signed SSL primary certificate to an existing Java keystore:

keytool -import -trustcacerts -alias mydomainname -file mydomainname.crt -keystore keystorefilename.jks

Java Keytool Commands for Conversion:

If you need to change the type of keystore.

PFX keystore to JKS keystore:

keytool -importkeystore -srckeystore mypfxfile.pfx -srcstoretype pkcs12 -destkeystore newjkskeystore.jks -deststoretype JKS

JKS keystore to PFX keystore:

keytool -importkeystore -srckeystore myjksfile.jks -srcstoretype JKS -deststoretype PKCS12 -destkeystore newpfxkeystore.pfx

To View JKS java keystore contents

Keytool -v -list -keystore keystorefilename.jks

For only Alias name and entries

Keytool -list -keystore keystorefilename.jks

Other Java Keytool Commands:

Delete a certificate from a Java Keytool keystore:

keytool -delete -alias mydomainname -keystore keystorefilename.jks

Change a Java keystore password:

keytool -storepasswd -new newstorepass -keystore keystorefilename.jks

Export a certificate from a keystore:

keytool -export -alias mydomainname -file mydomain.crt -keystore keystorefilename.jks

List Trusted CA Certs:

keytool -list -v -keystore $JAVA_HOME/jre/lib/security/cacerts

Import New CA into Trusted Certs:

keytool -import -trustcacerts -file /path/to/ca/ca.pem -alias mydomain -keystore $JAVA_HOME/jre/lib/security/cacerts

Most Common Sapgenpse commands

Create server PSE and certificate request using the following commands

sapgenpse get_pse <additional_options> -p <PSE_Name> -r <cert_req_file_name> -x <PIN> <Distinguished_Name>

For Example

sapgenpse get_pse -p SAPSSLS.pse -x abcpin -r abc.req " CN=Fully Qualified Domain Name, OU=dept. name, O=Organizational Name, SP=State and Province value, L=Locality value,C=ISO country code value".

Import  Certificate  Using SAPGENPSE 

sapgenpse import_own_cert <Additional_options> -p <PSE_file> -c <Cert_file> [-r <RootCA_cert_file>] -x <PIN>

sapgenpse Commands for Conversion:

SAPGENPSE commands to import pfx file into pse .

sapgenpse import_p12 -r intermediate.crt -r root.crt -p SAPSSLS.pse certificate.pfx

SAPGENPSE commands to export pfx file through pse .

sapgenpse export_p12 -p D:\usr\sap\ABC\PKI404\sec\filename.pse D:\usr\sap\ABC\PKI404\sec\newfilename.p12

Import  Certificate  Using SAPGENPSE 

sapgenpse import_own_cert <Additional_options> -p <PSE_file> -c <Cert_file> [-r <RootCA_cert_file>] -x <PIN>

Most Common commands for ORAPKI-OHS

ORACLE EWALLET(OHS)

Create an auto-login wallet and use the wallet: 

orapki wallet create -wallet C:\Oracle\Middleware\ssl\ohs\eWallet -auto_login -pwd Oracle123

Create selfsigned certificate command :- 

orapki wallet add -wallet C:\Oracle\Middleware\ssl\ohs\eWallet -dn "CN= www.pki404.com, OU=IT, O=PKI404 PVT LTD, L=New Delhi, ST=Delhi, C=IN" -keysize 2048 -pwd Oracle123 -validity 365

Export the CSR from the wallet: 

Command: orapki wallet export -wallet C:\Oracle\Middleware\ssl\ohs\eWallet -dn "CN= www.pki404.com, OU=IT, O=PKI404 PVT LTD, L=New Delhi, ST=Delhi, C=IN" -request C:\Oracle\Middleware\ssl\ohs\filename.csr

Import CA Inter, CA Root, brownbag (ohs) certificates into the wallet 

Command: 

orapki wallet add -wallet C:\Oracle\Middleware\ssl\ohs\eWallet -pwd Oracle123 -trusted_cert -cert C:\Oracle\Middleware\ssl\CAInter.pem 

Command: 

orapki wallet add -wallet C:\Oracle\Middleware\ssl\ohs\eWallet -pwd Oracle123 -trusted_cert -cert C:\Oracle\Middleware\ssl\CARoot.pem 

Command: 

orapki wallet add -wallet C:\Oracle\Middleware\ssl\ohs\eWallet -pwd Oracle123 -user_cert -cert C:\Oracle\Middleware\ssl\ohs\pki404.pem

Using the jks file let us create a wallet: 

Create an empty wallet with auto login: 

C:\Oracle\Middleware\oracle_common\bin\orapki wallet create -wallet C:\Oracle\Middleware\ssl -auto_login -pwd Oracle123

Convert the jks to a wallet: 

C:\Oracle\Middleware\oracle_common\bin\orapki wallet jks_to_pkcs12 -wallet C:\Oracle\Middleware\ssl\eWallet -pwd Oracle123 -keystore C:\Oracle\Middleware\ssl\myIdentity.jks -jkspwd Oracle123

Stay tuned for more blogs:) Any suggestions are welcome on our social handles and comment section.

 Hello Everyone, Welcome to another article where we will share step by step process to generate pfx PKCS12 using private key and certificate along with chain certificate for third party CA also for self sign certificates. So lets begin without any further due.

Create pfx PKCS12 using certificate and private key file for third party CA

DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEYDCCA0igAwIBAgILBAAAAAABL07hRQwwDQYJKoZIhvcNAQEFBQAwVzELMAkG
A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv

After chain bundle file is created use  below command after modifying file names to create pfx, same command can be used on windows and linux.

openssl pkcs12 -export -out certificate.pfx -inkey privatekey.key -in domain.cer -certfile chain.cer

And keep any strong password atleast of 6 digit and it will export pfx file.

Also read:- How to create a JKS file

Stay tuned for more blogs :)

  Hello Everyone Welcome to another exciting blog where i walk you through step by step ssl configuration on jboss wildfly, so let's start without any further due.

JBOSS WILDFLY CONFIGURATION FOR FIRST TIME INSTALLATION

Install ssl on jboss wildfly.

Note: Take backup of original standalone.xml before moving towards configuration  modification.

Create a complete JKS/Keystore file and then proceed with below changes.

Visit here to create JKS keystore file : How to create JKS keystore file.

1.     Configure WildFly for HTTPS Connector

1. Navigate to $JBOSS_HOME/standalone/configuration directory and open the standalone.xml file.

Go to <management> element configuration

And Add below connector under <security-realm name="ApplicationRealm"> just before the <authentication>  tag

<server-identities>

        <ssl>

      <keystore path="yourjksfile.keystore" relative-to="jboss.server.config.dir" keystore-password="PASSWORD" alias="jboss"/>

       </ssl>

      </server-identities>

After adding the entry it looks like below entry

Note: The <authentication> and <authorization> elements are mandatory.

Bonus Tip 😎: Make sure you place jks/keystore file in configuration folder and define keystore file without any path, similar to above screenshot. e.g  path="yourjksfile.keystore"

Now that 1^st step is completed, Let’s move towards our next step.

1.     Locate the "http-remoting-connector"  and make sure it is there

<http-connector name="http-remoting-connector" connector-ref="default" security-realm="ApplicationRealm"/>

It should be under

<subsystem xmlns="urn:jboss:domain:remoting:3.0">

            <endpoint/>

It will look like below highlighted area

If it is there that’s great then let’s move to the next step.

1.     Locate the "https-listener"  if unable to find then follow below steps to add one.

Add below line connector

<https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" enable-http2="true"/>

Above connector needs to be placed under

<subsystem xmlns="urn:jboss:domain:undertow:3.1"> (values can be different as 3.0 or 3.1 etc here we have 3.1)

            <buffer-cache name="default"/>

            <server name="default-server">

                <http-listener name="default" max-parameters="400000" max-post-size="1717986920" socket-binding="http" redirect-socket="https"/>

After placing the code it will look like below screenshot.

Lets move ahead with our 4^th option which is port configuration

1.     Port Configuration

1. Navigate to $JBOSS_HOME/standalone/configuration directory and open the standalone.xml file.
2. Change the default WilfFly HTTPS port from 8443 to 443 under <socket-binding-group>:

c.  <socket-binding-group name="standard-sockets" default-interface="public" ...>

d.  <socket-binding name="http" port="80" />

e.  <socket-binding name="https" port="443" />

f.  ...

</socket-binding-group>

In my case I am using 8443, see the below screenshot.

1. Save the updated standalone.xml file.
2. Restart jboss-wildfly services to test the configuration.
   
   
1. Verify SSL Configuration
1. Type the following url into your browser:

https://IPaddress:443/eml/Login

If the your page Login screen is displayed, an SSL is successfully configured.

Stay tune for more such blogs :)

 Hello Everyone, Welcome to another important blog post where i will walk you through step by step to generate jks (java keystore) file. Follow the below steps.

Create a JKS file java keystore for tomcat and jboss

We will be requiring below files to create JKS java keystore file in terms of third party CA.

1.Root certificate

2.Intermediate certificate

3.Domain certificate

4.Private key

merge intermediate and root to create chain file.

cat intermediate.cer root.cer > chain.crt

it will export chain.crt

In windows just copy the root certificate content and paste under intermediate one and make sure there is no space after -----End Certificate----- and save it as chain.crt

See the below example.

DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEYDCCA0igAwIBAgILBAAAAAABL07hRQwwDQYJKoZIhvcNAQEFBQAwVzELMAkG
A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv

Now run below command to generate pfx in openssl. for windows run in openssl/bin make sure openssl.cnf is available in bin, if using apache/bin then copy openssl.cnf from conf directory and paste in bin directory.

For Windows

openssl pkcs12 -export -out certificate.pfx -inkey privatekey.key -in domain.crt -certfile chain.crt -config openssl.cnf

keep atleast 6 digit password.

For Linux

openssl pkcs12 -export -out certificate.pfx -inkey privatekey.key -in domain.crt -certfile chain.crt

keep atleast 6 digit password.

it will export pfx file.

now run below command to covert pfx to jks, if you have windows run in java/jdk or jre bin, if linux run anywhere.(Java must be installed to run the below command)

keytool -importkeystore -srckeystore certificate.pfx -srcstoretype pkcs12 -destkeystore certificate.jks -deststoretype JKS

 give the same password as pfx else keystore won't work.

now import root and intermediate certificate also 

run command

keytool -import -trustcacerts -alias intermediate –file intermediateCertFileName.crt -keystore certificate.jks

it will import intermediate cert

now for root cert

keytool -import -trustcacerts -alias root –file RootCertFileName.crt -keystore certificate.jks

after doing above steps verify the jks by running below command

keytool -v -list -keystore certificate.jks

Note the alias name for private key from output And also make sure private key entry chain length is 3 to avoid intermediate certificate error on browsers.

Also read: How to install ssl on tomcat

Stay tuned for more such blogs. See you in next one. :)

Hello Everyone, Welcome to another blog where i'll walk you through step by step CSR generation process on Apache web server. So lets start without any further due.

Generate a CSR on a Linux server

    At the command prompt, type the following and hit Return. Change the bit length (2048) to the appropriate bit length for the SSL issuer. Typically 2048 is sufficient.

    General OpenSSL Commands

Step 1: Generate a Key Pair

The utility “openssl” is used to generate the key and CSR. This utility comes with theOpenSSL package and is usually installed under /usr/local/ssl/bin. If you have installed them elsewhere you will need to adjust these instructions appropriately.

Type the following command at the prompt:

•             Generate a new private key and Certificate Signing Request           

openssl req -out domain.csr -new -newkey rsa:2048 -nodes -keyout domainprivate.key 

    Fill out the requested information below. For the State, use the full name not an abbreviation. The Organization Name should be a publicly verifiable name (such as is listed on bank statements, bills, taxes, etc). The common name is the domain for which the SSL is being issued. For example, if you're ordering an SSL for domain.com, then the name would be domain.com. If you're ordering an SSL for www.domain.com, then the name would be www.domain.com, for wildcard certificate use *.domain.com

    You may chose to leave the email address and challenge password blank by simply hitting return when prompted.

    Generating a 2048 bit RSA private key

    ...........+++

    .............................+++

    writing new private key to 'private.key'

    -----

    You are about to be asked to enter information that will be incorporated

    into your certificate request.

    What you are about to enter is what is called a Distinguished Name or a DN.

    There are quite a few fields but you can leave some blank

    For some fields there will be a default value,

    If you enter '.', the field will be left blank.

    -----

    Country Name (2 letter code) :IN

    State or Province Name (full name):Delhi

    Locality Name (eg, city:New Delhi

    Organization Name (eg, company) [My Company Ltd]:My Company Name (e.g. PKI404)

    Organizational Unit Name (eg, section) []:Security

    Common Name (eg, your name or your server's hostname) []:www.domain.com (e.g www.pki404.com)

    Email Address []: Not Required(do not enter anything)

    Please enter the following 'extra' attributes

    to be sent with your certificate request

    A challenge password []: Not Required(do not enter anything)

    An optional company name []: Not Required(do not enter anything)

    Once the form is filled out, two files will be created in the directory in which the command was run one will be domain.csr and other domainprivate.key. The file domain.csr has the CSR for the SSL which will need to provide to the SSL issuer.

Stay tuned for more such blogs. :)

x

 Hello Everyone, Welcome to another blog where i'll walk you through step by step ssl certificate installation on Apache Tomcat server. So lets start without any further due.

Apache Tomcat ssl installation steps 

Tomcat SSL Installation Instructions

1. Download your certificate files from your certificate authority and save them to the same directory as the keystore that you created during the CSR creation process. The certificate will only work with the same keystore that you initially created the CSR with. The certificates must be installed to your keystore in the correct order.

2. Install the Root Certificate file in java keystore: Every time you install a certificate to the keystore you must enter the keystore password that you chose when you generated it. Enter the following command to install the Root certificate file:

keytool -import -trustcacerts -alias root –file RootCertFileName.crt 

-keystore yourdomain.jks

3. Install the Intermediate Certificate file in java keystore: If your certificate authority provided an intermediate certificate file, you will need to install it here by typing the following command:

keytool -import -trustcacerts -alias intermediate -file

 IntermediateCertFileName.crt -keystore yourdomain.jks

If successful, you will see "Certificate was added to keystore".

4. Install the Primary Certificate file in java keystore: Type the following command to install the Primary certificate file (for your domain name):

keytool -import -trustcacerts -alias tomcat -file

 PrimaryCertFileName.crt -keystore yourdomain.jks

If successful, you will see "Certificate reply was installed in keystore". You now have all the certificates installed to the keystore file. You just need to configure your server to use the keystore file.

Configuring your SSL Connector

Tomcat will first need an SSL Connector configured before it can accept secure connections.

1.    Open the Tomcat server.xml file in a text editor (this is usually located in the conf folder of your Tomcat's home directory).

2.    Find the connector that will be secured with the new keystore and uncomment it if necessary (it is usually a connector with port 443 or 8443 like the example below).

3.    Specify the correct keystore filename and password in your connector configuration. When you are

<Connector port="443" protocol="HTTP/1.1" maxThreads="150" scheme="https" secure="true" SSLEnabled="true" keystoreFile="conf/yourdomain.jks" keystorePass="keystorepassword" clientAuth="false" SSLProtocol="TLSv1+TLSv1.1+TLSv1.2" keyAlias="server" ciphers="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA" />

Note: If you are using version 7 of Tomcat you will need to change "keypass" to "keystorePass".

4.    Save your changes to the server.xml file.

5.    Restart Tomcat.

That's it for now, Hope this has helped you. Stay tuned for more.

Don't forget to bookmark this page for your future references. :)

  Hello Everyone, Welcome to another blog where i'll walk you through step by step CSR generation on Apache Tomcat server. So lets start without any further due.

Apache Tomcat CSR generation steps

CSR GENERATION STEPS:-

Step A -- Create a new Keystore

1.    You will be using the keytool command to create your new key-CSR pairing. Enter the following:

keytool -genkey -alias server -keyalg RSA -keysize 2048 -keystore yourdomain.jks

'Yourdomain' is the name of the domain you are securing. However, if you are ordering a Wildcard Certificate, do not include * in the beginning of the filename as this is not a valid filename character.

2.    You will be prompted for the DN information. Please note: when it asks for first and last name, this is not YOUR first and last name, but rather your domain name and extension(i.e., www.yourdomain.com). If you are ordering a Wildcard Certificate this must begin with *. (example: *.domain.com)

3.    Confirm that the information is correct by entering 'y' or 'yes' when prompted. Next you will be asked for your password to confirm. Make sure to remember the password you choose.

Step B -- Generate your CSR with your new keystore

1.    Next, use keytool to actually create the Certificate Signing Request. Enter the following:

keytool -certreq -alias server -keyalg RSA -file yourdomain.csr -keystore yourdomain.jks

Again, 'yourdomain' is the name of the domain you are securing. (without the * character if you are ordering a Wildcard Certificate).

2.    Enter the keystore password.

3.    Then the SSL Certificate CSR file is created. Open the CSR with a text editor, and copy and paste the text (including the BEGIN and END tags) into the Certificate Authority web order form.

Hope you have generated CSR without any issue, Now follow the next step for ssl installation

Also read : Apache Tomcat ssl installation steps