Creating the Certificate Using Java Keytool

Technical Articles

Solution

Application

Content Type

Technical Documentation

Utilities & Services

ft:locale

en-US

Requirements

This workflow requires Java to be installed on the workstation on which you build the keystore.

Open a command prompt or Terminal window.
Create a folder on your desktop named Certs and navigate to the directory using the following commands:
```
mkdir /path/to/Desktop/Certs
cd /path/to/Desktop/Certs
```
Generate a keystore by executing a command similar to the following:
```
/path/to/keytool -genkey -alias tomcat -keyalg RSA -keysize 2048 -keypass "password" -storepass "password" -keystore keystore.jks
```
Note:
Make sure to use the same password for both the keypass and the storepass. The password cannot contain special characters. You must remember this password for future imports.
Create a backup copy of the keystore and store it in a safe location.
When prompted, enter the appropriate information. The certificate authority (CA) administrator should be able to provide the desired values for these fields. Be sure to use a fully qualified domain name (FQDN), such as jamf.mycompany.com.
Generate a certificate signing request (CSR) from the keystore you just created by executing the following command:
```
/path/to/keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore keystore.jks
```
Send the CSR you just created to a valid CA (public or internal). You should receive a .crt, .cer, or .pem file in return.
Note:
If you are requesting separate certificates, request a Base 64 encoded binary (X.509).
Place the certificates you received into the Certs folder on your desktop.

Import the signed certificate(s) into your keystore. If you are using a combined certificate, execute the following command:

/path/to/keytool -import -alias tomcat -keystore keystore.jks -trustcacerts -file root.cer

If you are using multiple certificates (such as an intermediate and/or root certificate and a signed web certificate), execute commands like the following to install each certificate:

/path/to/keytool -import -alias root -keystore keystore.jks -trustcacerts -file root.cer
/path/to/keytool -import -alias intermediate1 -keystore keystore.jks -trustcacerts -file intermediate1.cer
/path/to/keytool -import -alias tomcat -keystore keystore.jks -trustcacerts -file cert.cer