You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "Bomma, Nithun" <Ni...@amtrak.com> on 2014/03/31 16:19:29 UTC
SSL Certificates
Hello,
We are using WebSphere v6.1 for SSO and we are moving to ForgeRock and it uses Apache Tomcat (v7.0.37)
We are trying to import the certificates (Verisign) including the chain certificates from WebSphere to Tomcat.
Have any of you did this before? If yes, could you help us out?
Thanks,
Nithun
Re: SSL Certificates
Posted by "James H. H. Lampert" <ja...@touchtonecorp.com>.
On 3/31/14 10:32 AM, Blume Wolfgang wrote:
> Hi,
> If your certificate need not be changed,
> then you need not create a new Certificate Signing Request (CSR) to get a
> new certificate,
> but only do the "Importing the Certificate" part of the description:
> Import chain certificate, then your existing certificate.
Of course, that presupposes that you can export the certificate in a
format that Tomcat can use.
If we're talking WebSphere on an AS/400, it probably uses DCM. And if
we're talking Tomcat on an AS/400, the only option I'm aware of is a
Java keystore. And if there's a way to get from the former to the
latter, I wouldn't mind knowing about it myself: we've had customers
jump the gun, and generate DCM-compatible certificates, not knowing that
Tomcat didn't use them.
--
JHHL
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL Certificates
Posted by Blume Wolfgang <wo...@gmail.com>.
Hi,
If your certificate need not be changed,
then you need not create a new Certificate Signing Request (CSR) to get a
new certificate,
but only do the "Importing the Certificate" part of the description:
Import chain certificate, then your existing certificate.
Wolfgang
2014-03-31 16:45 GMT+02:00 Bomma, Nithun <Ni...@amtrak.com>:
> Thanks Leo!
>
> I don't want to create a new CSR, since the certificate with WebSphere
> exists until 2015.
>
> I just want to export the certificate with chain from WebSphere and import
> into Tomcat directly.
>
> Any thoughts?
>
> Thanks,
> Nithun Bomma
> WebSphere Administrator
> Amtrak - Information Technology (Operations)
> AIM: nithunbomma
> EMAIL: Nithun.Bomma@amtrak.com
> Desk: 215-349-2065; ATS: 728-2065; Cell: 215-704-4981
> -----Original Message-----
> From: Leo Donahue [mailto:donahulf2@gmail.com]
> Sent: Monday, March 31, 2014 10:39 AM
> To: Tomcat Users List
> Subject: Re: SSL Certificates
>
> On Mon, Mar 31, 2014 at 7:19 AM, Bomma, Nithun <Nithun.Bomma@amtrak.com
> >wrote:
>
> > Hello,
> >
> > We are using WebSphere v6.1 for SSO and we are moving to ForgeRock and
> > it uses Apache Tomcat (v7.0.37)
> >
> > We are trying to import the certificates (Verisign) including the
> > chain certificates from WebSphere to Tomcat.
> >
> > Have any of you did this before? If yes, could you help us out?
> >
> > Thanks,
> > Nithun
> >
>
> It's all right here:
>
> http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html#Installing_a_Certificate_from_a_Certificate_Authority
>
> Where do you need help specifically?
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
RE: SSL Certificates
Posted by "Bomma, Nithun" <Ni...@amtrak.com>.
Thanks Leo!
I don't want to create a new CSR, since the certificate with WebSphere exists until 2015.
I just want to export the certificate with chain from WebSphere and import into Tomcat directly.
Any thoughts?
Thanks,
Nithun Bomma
WebSphere Administrator
Amtrak - Information Technology (Operations)
AIM: nithunbomma
EMAIL: Nithun.Bomma@amtrak.com
Desk: 215-349-2065; ATS: 728-2065; Cell: 215-704-4981
-----Original Message-----
From: Leo Donahue [mailto:donahulf2@gmail.com]
Sent: Monday, March 31, 2014 10:39 AM
To: Tomcat Users List
Subject: Re: SSL Certificates
On Mon, Mar 31, 2014 at 7:19 AM, Bomma, Nithun <Ni...@amtrak.com>wrote:
> Hello,
>
> We are using WebSphere v6.1 for SSO and we are moving to ForgeRock and
> it uses Apache Tomcat (v7.0.37)
>
> We are trying to import the certificates (Verisign) including the
> chain certificates from WebSphere to Tomcat.
>
> Have any of you did this before? If yes, could you help us out?
>
> Thanks,
> Nithun
>
It's all right here:
http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html#Installing_a_Certificate_from_a_Certificate_Authority
Where do you need help specifically?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL Certificates
Posted by Leo Donahue <do...@gmail.com>.
On Mon, Mar 31, 2014 at 7:19 AM, Bomma, Nithun <Ni...@amtrak.com>wrote:
> Hello,
>
> We are using WebSphere v6.1 for SSO and we are moving to ForgeRock and it
> uses Apache Tomcat (v7.0.37)
>
> We are trying to import the certificates (Verisign) including the chain
> certificates from WebSphere to Tomcat.
>
> Have any of you did this before? If yes, could you help us out?
>
> Thanks,
> Nithun
>
It's all right here:
http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html#Installing_a_Certificate_from_a_Certificate_Authority
Where do you need help specifically?
Re: SSL Certificates
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Nithun,
On 4/1/14, 4:02 PM, Bomma, Nithun wrote:
> I want to get public & private keys from WebSphere and import into
> Tomcat.
>
> We have WebSphere certificates (Signed by Verisign) until 2015 and
we > want to use the same in tomcat.
Where are the keys, now? Are they in a keystore? If so, open that
keystore and export the key and certificate. Then, import them into
another keystore for use with Tomcat.
> When I create a keystore (keytool -genkey -alias tomcat -keyalg RSA
> -keystore /opt/tomcat/SSL/tomcat.keystore), a keystore is getting
> created. But I'm unable to import the certificates into it.
You don't want to use "genkey" because that will create a new key. You
already have a key. You want to import from an existing keystore into
a new one.
> Is there any document or documentation which might be helpful?
> Could you please let me know?
Did you try Googling for "export websphere certificate into tomcat"?
We don't exactly document that procedure in the Tomcat documentation.
You can probably go back to VeriSign and ask for the certificate
again, then import that into your keystore. As for the server key,
you're going to have to get that from wherever Websphere keeps it.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJTOyrKAAoJEBzwKT+lPKRYfaMP/Rw7EpCb/aesr9LxS+ZIV1cU
IvsQgM0CKgVR03YwGk/+6lPwi/596xXfVMXmFI/Ekzen6jx1H/GgXvAUYtEnnqJc
nf+TgVGAZ7JIZ1zcffX24Rv86xecPdMpuvxekyOdrBDITCnDCGCt3jkA/VozrACL
0FfiGNVJTJEuQSIuPkA3jWFE5Ci98RFvMRTo7YEsBmOmQm9pNHw9zUFrV8Con4Yt
TYGCvVHFJ2DypS0z0f0DvJ0BkZ8QIYAbGp2Tx9YREOSbQzYzqmrjJIXlw3QixHkV
qcAN+xnhu4OPk/5HKGPPMenHhaj+a2Ukg08MnvPoLD8Ml24+i4KNBFbapgR9cUOz
M/c91EH8TLr/WXSlR+7YTGVlm1plwWkancEBsBImTQeRmW4TFJg9/lohV0pSum7D
tLi5UbgE4JrwT++OukDJ553Cavg+Pv5v5awM1aL/SKlwtBPZG19ppjBjqkAsudmE
1Wf+ZPr77Fb9AhzU182DzhHcoIFT4EaQ8EdqZAOpl7idgNsRnHN25YWNp1O8wsJk
QFvqOcsGddIhZ6AdZ1nN+TLCk4hTazhttWToHwB3MHIY9tDXDnj9yjOM9ZLmVz4f
U2pyfitJ6UlplCvhzWZSZ+tq8nmWPeYkXHyZf4L0FO9PlxkCn0Jl6pt7f9KBbV/x
DYsBY1XNqiEg6TQgRGj5
=JmZE
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: SSL Certificates
Posted by "Bomma, Nithun" <Ni...@amtrak.com>.
Thanks Chris!
I want to get public & private keys from WebSphere and import into Tomcat.
We have WebSphere certificates (Signed by Verisign) until 2015 and we want to use the same in tomcat.
When I create a keystore (keytool -genkey -alias tomcat -keyalg RSA -keystore /opt/tomcat/SSL/tomcat.keystore), a keystore is getting created. But I'm unable to import the certificates into it.
Is there any document or documentation which might be helpful? Could you please let me know?
Thanks.
-----Original Message-----
From: Christopher Schultz [mailto:chris@christopherschultz.net]
Sent: Monday, March 31, 2014 2:58 PM
To: Tomcat Users List
Subject: Re: SSL Certificates
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Ninthun,
On 3/31/14, 10:19 AM, Bomma, Nithun wrote:
> Hello,
>
> We are using WebSphere v6.1 for SSO and we are moving to ForgeRock and
> it uses Apache Tomcat (v7.0.37)
>
> We are trying to import the certificates (Verisign) including the
> chain certificates from WebSphere to Tomcat.
>
> Have any of you did this before? If yes, could you help us out?
Websphere probably should be using Java keystores. You should just be able to use the same keystore, although something might need to be re-named or something.
Save yourself a huge headache and use Portecle:
http://portecle.sourceforge.net/
You should be able to take your server key and issued certificate and create a new Java Keystore to use with the BIO or NIO connectors. If you are using APR, then you will have to export your key and certificate to individual files and configure them appropriately.
Hope that helps,
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJTObq8AAoJEBzwKT+lPKRY99sQAKdQryt76EFPHD42vk72o/pJ
vgBaWBsLL57rK+6LgsUSuNneTviGaBkDY6kBVjnGzA1w3I9MJn4XnhX8Pm/Z1ZQd
rpYDk3/E+CI2Gh5C6HTkgcXE/hffQ8xKAhS/CZj4riJu6S3YSIPFtX6H3vTkQD1A
tWlUE8fEWm0Wo529izbiPPPseZTBdAU1Sbv4z4AEjZolrxyvE6Bm0GSyvSYTu5cm
g0oxv7hoSl8IxKHaI6mxmRFLCrBSRBmIHp6vSB7OHzmx0pi6UuZzWnhjL9N1VhZ6
zA3vxlQlicXxjMdWOY2dsy6GLxzK+CmOK61Fk52uJMRJgEz1Dzdb2hyuypdt1aVC
F160wtePQpbYkjnXusjsfE8PsiZxFyiFOBbfVnoni6yY7DiVSID5lglbvXPjnveA
jMCHKTjDrGZAeou7Tuu1aUMqvg9kaSOlCGAstK5G5wuAV8GSvGoqAfuZ70EbrTdj
pqK4xGl+uFKaJfw0bkFzD6seSWevk8CiWCZ46h3JVISM42VWqtiWnfKkTNjFSUVx
ECFll3YGmEwWbwo9cTDHD/GJYMqi878vhA34v/YmOVFLV6dVy0hOjudC6NXeu9/t
Hk2AGm82Fi5mgP3ZWT8K35/GcH1ezd77M+jFmikFjCZC6btZw26ir2A9i2xbdZ//
In71YEw3kQauMHA6UsgL
=BbUU
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL Certificates
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Ninthun,
On 3/31/14, 10:19 AM, Bomma, Nithun wrote:
> Hello,
>
> We are using WebSphere v6.1 for SSO and we are moving to ForgeRock
> and it uses Apache Tomcat (v7.0.37)
>
> We are trying to import the certificates (Verisign) including the
> chain certificates from WebSphere to Tomcat.
>
> Have any of you did this before? If yes, could you help us out?
Websphere probably should be using Java keystores. You should just be
able to use the same keystore, although something might need to be
re-named or something.
Save yourself a huge headache and use Portecle:
http://portecle.sourceforge.net/
You should be able to take your server key and issued certificate and
create a new Java Keystore to use with the BIO or NIO connectors. If
you are using APR, then you will have to export your key and
certificate to individual files and configure them appropriately.
Hope that helps,
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJTObq8AAoJEBzwKT+lPKRY99sQAKdQryt76EFPHD42vk72o/pJ
vgBaWBsLL57rK+6LgsUSuNneTviGaBkDY6kBVjnGzA1w3I9MJn4XnhX8Pm/Z1ZQd
rpYDk3/E+CI2Gh5C6HTkgcXE/hffQ8xKAhS/CZj4riJu6S3YSIPFtX6H3vTkQD1A
tWlUE8fEWm0Wo529izbiPPPseZTBdAU1Sbv4z4AEjZolrxyvE6Bm0GSyvSYTu5cm
g0oxv7hoSl8IxKHaI6mxmRFLCrBSRBmIHp6vSB7OHzmx0pi6UuZzWnhjL9N1VhZ6
zA3vxlQlicXxjMdWOY2dsy6GLxzK+CmOK61Fk52uJMRJgEz1Dzdb2hyuypdt1aVC
F160wtePQpbYkjnXusjsfE8PsiZxFyiFOBbfVnoni6yY7DiVSID5lglbvXPjnveA
jMCHKTjDrGZAeou7Tuu1aUMqvg9kaSOlCGAstK5G5wuAV8GSvGoqAfuZ70EbrTdj
pqK4xGl+uFKaJfw0bkFzD6seSWevk8CiWCZ46h3JVISM42VWqtiWnfKkTNjFSUVx
ECFll3YGmEwWbwo9cTDHD/GJYMqi878vhA34v/YmOVFLV6dVy0hOjudC6NXeu9/t
Hk2AGm82Fi5mgP3ZWT8K35/GcH1ezd77M+jFmikFjCZC6btZw26ir2A9i2xbdZ//
In71YEw3kQauMHA6UsgL
=BbUU
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org