HOWTO: Filling keystore with SSL certificate

[a harald <a_...@yahoo.com>]

There is a step by step description on how to obtain a
ssl certificate from a certificate authority and how
to install it for use with tomcat on
http://jakarta.apache.org/tomcat/tomcat-4.1-doc/ssl-howto.html

Because providers (at least mine) are not used to
Tomcat, they don't follow the step by step description
for Tomcat, but the one for Apache :-(
http://httpd.apache.org/docs-2.0/ssl/ssl_faq.html#realcert

The problem is, that keytool refuses to import the
signed certificate in a keystore, if the keystore was
not used to create the certificate signing request!


Here is, how to do:

1) Create a local certificate as described in the
ssl-howto (with alias tomcat)

2) Import the chain certificate from the provider as
described in the ssl-howto

3) Transform the private key .pem file from in DER
format with
openssl pkcs8 -topk8 -in <private-key.pem> -out
banana.data -nocrypt -outform DER

4) Download the bouncy castle library from
http://www.bouncycastle.org/
 
5) Overwrite the local certificate with the java
program below
java -classpath classes/ ImportCert changeit
banana.data <certificate.pem> .keystore tomcat
6) Delete banana.data!!!

Here is the program:


import java.security.cert.*;
import java.io.*;
import java.security.*;
import java.security.spec.*;


public class ImportCert {

   /**
   * args[0] The keystore password
   * args[1] The privatekey file stored as a PKCS#8
with no
   password protection
   * args[2] The public key in an X509 certificate.
   * args[3] The location of the keystore
   * args[4] The alias for the pair
   * Creation date: (5/18/01 3:24:51 PM)
   * @param args java.lang.String[]
   */
   public static void main(String[] args)
   {
      //
      // This will import a X509 certificate
containing a public key
      // and a PKCS#8 private key file that is NOT
protected by a password into
      // a keystore specified.
      //
      if (args.length != 5) {
         System.out.println("Usage: java -classpath
bcprov-jdk14-115.jar:. ImportCert <keystore password>
<private key file> <certificate file> <keystore file>
<alias (name for key in keystore)>");
         System.exit(0);
      }
      try
      {
         java.lang.String privateKey = args[1];
         java.lang.String publicKey = args[2];

         // Import open JCE
         Provider provider = new
org.bouncycastle.jce.provider.BouncyCastleProvider();
         Security.addProvider(provider);

         // Read in the private key
         File f = new File(privateKey);
         byte[] encodedKey = new byte[(int)
f.length()];
         FileInputStream fis = new
FileInputStream(privateKey);
         fis.read(encodedKey);
         fis.close();
         PKCS8EncodedKeySpec kspec = new
PKCS8EncodedKeySpec(encodedKey);
         KeyFactory kfac =
KeyFactory.getInstance("RSA",provider);
         PrivateKey privKey =
kfac.generatePrivate(kspec);

         // Read in the public key certificate
         InputStream inStream = new
FileInputStream(publicKey);
         CertificateFactory cf =
CertificateFactory.getInstance("X.509");
         X509Certificate cert =
(X509Certificate)cf.generateCertificate(inStream);
         inStream.close();
         java.security.cert.Certificate[] certChain =
new
         java.security.cert.Certificate[1];
         certChain[0]=cert;

         // get the password from the arguements for
the keystore
         String arg0 = args[0];
         char[] password = new char[arg0.length()];
         arg0.getChars(0,arg0.length(),password,0);

         // Load the keystore
         InputStream archivo = new
FileInputStream(args[3]);
         KeyStore store =
KeyStore.getInstance("JKS","SUN");
         store.load(archivo,password);

         // Store the new key entry
         store.setKeyEntry(args[4], privKey, password,
certChain);

         // Store the store
         OutputStream os = new
FileOutputStream(args[3]);
         store.store(os,password);
      }
      catch(Exception e)
      {
         e.printStackTrace();
      }
   }

}
 
Thanks to klagesb5, the above program follows closely
what he posted on
http://forum.java.sun.com/thread.jsp?forum=9&thread=15101



__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>