Acquiring and Using
Server Certificates

INDEX:
1.	Acquiring a Server Certificate
a.	Generate a rsa key
b.	Generate a request for a certificate
2.	Creating a java keystore containing a Server Certificate
Obtaining the mitca.cer.
3.	Creating a server trust store.
Obtaining the mitClient.cer
4.	Using the keystores with Tomcat

1.  Acquiring a Server Certificate

a.	Generate an rsa key

For UNIX or LINUX systems:

On the system you want the certificate for:

1.  Create a directory which will be used to for generating the certificate request.
2.  cd to the newly created directory.
3.  Now generate some random stuff by doing the following command lines:

ps > foo
ps –elf  >>  foo
	
4.  Execute the following command:

openssl genrsa -rand foo 1024  >  [servername]-key.pem

For WINDOWS systems:

Generate an rsa key:

1.	Create a directory which will be used to for generating the certificate request.
2.	cd to the newly created directory.
3.	Execute the following command: 

openssl genrsa 1024  >  [servername]-key.pem

where [appname] matches the name the final certificate will apply to, i.e. for “foo.app.mit.edu,” you would name this file foo-key.pem

b.	Generate a request for a certificate

To generate a request for a certificate, execute to following command line:

openssl req -key [servername]-key.pem -new  > req.pem

Where [servername] is as in a) above.

When prompted for input, use these answers: (or use the default answers for all but Common name and challenge password)

Country Name (2 letter code): US
State or Province Name (full name): Massachusetts
Locality Name (eg, city): Cambridge
Organization Name (eg, company): Massachusetts Institute of Technology
Organizational Unit Name (eg, section): (e.g. Information Services & Technology)
Common Name (eg, YOUR name): name of the server (machine.mit.edu)
Email Address: enter your MIT email address
A challenge password: (anything you choose - you should remember in case jis challenges you)
An optional company name: (no entry required)

The file, req.pem, contains the information for your certificate.  Cut and paste the contents of this file into an email and sent it to mitcert@mit.edu.  When you paste the contents of the req.pem file into the email, be sure to include the BEGIN and END lines.  

The Subject line of the email should read: Request of a Server Certificate.

Also include in the body of the email, a short line stating that you are requesting a Server Certificate.  Stating that you want a Server Certificate is important.

2.  Creating a java keystore containing a Server Certificate.

After a few days, you will receive an email that has your Server Certificate as an attachment.  Save the Server Certificate to the directory you created in 1a above.  You can change the name of the certificate file to something that is meaningful to you.  In this document, the Server Certificate was assumed to be saved as [servername].pem, where [servername] is as in section 1 above.

View the Server Certificate to verify that you have the correct certificate.  To view the certificate, execute the following command line:

openssl x509 –in [servername].pem ‑text

Find the line that says: Netscape Cert Type.  The line immediately following this line should say:  SSL Client, SSL Server, S/MIME.  If this is not the case, then you have the wrong type of server certificate.

Also verify that the issuer of the certificate is the MIT certificate authority by finding the following line:

Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority

Also verify that the certificate is for your machine by finding your machine name in the certificate’s Subject: line.

Finally verify the certificate’s activation and expiration dates by looking at the two lines following Validity.

a)	The Server Certificate must be converted from x509v3 format to a pkcs12 format.  To do this, obtain the mitca.cer (this is the mit CA public key) and place it in the directory you created in 1a.  You can get the mitca.cer by going to http://ca.mit.edu/mitca.crt and saving the certificate to your working directory as mitca.cer.

To convert the Server Certificate to a pkcs12 format, execute the following command line:

openssl pkcs12 -in [servername].pem -inkey [servername]-key.pem -export –out [servername].p12 -nodes -CAfile mitca.cer
	
When prompted for a password, use a password that is well known to you.  Don’t forget this password because you will need it when configuring Tomcat or an application to use this keystore.

b)	[servername].p12 is a keystore that now contains the new server certificate.  This certificate must now be imported into a java keystore.

For Java JDK 1.6 or later:

To create the java keystore, execute the following command line:

keytool -importkeystore -srckeystore [servername].p12 -destkeystore [servername].jks -srcstoretype pkcs12 -deststoretype jks

When prompted for a password, use a password that is well known to you.  Don’t forget this password because you will need it when configuring Tomcat or an application to use this keystore.

For example:  If your machine name is foo.mit.edu, the command line would be:

keytool -importkeystore -srckeystore foo.mit.edu.p12 -destkeystore foo.mit.edu.jks -srcstoretype pkcs12 -deststoretype jks

Change the alias of the certificate stored in the jks by executing the following command line:

keytool -changealias -keystore [servername].jks -alias 1 -destalias [servername]

For example:  If your machine name is foo.mit.edu, the command line would be:

keytool -changealias -keystore foo.mit.edu.jks -alias 1 -destalias foo.mit.edu

For Java JDK 1.5 or earlier

To create a java keystore, obtain a copy of PKCS12Import.jar and place it in your working directory.  Execute the following command line:

java -jar PKCS12Import.jar [servername].p12 [servername].jks changeit

The keystore password will be set to changeit.

For example:  If your certificate name is foo.app.mit.edu, the command line would be:

java -jar PKCS12Import  foo.mit.edu.p12  foo.mit.edu.jks changeit

NOTE:  You can download PKCS12Import.jar from:

https://wikis.mit.eduDashboardDeveloper Software & Platform Services Projects Home Pageusing X509 certificatesacquiring and using x509 server certificatesAttachments

c)	Verify that the keystore was created successfully by executing the following command line:

keytool -list -keystore [servername].jks

If everything is correct, something similar to the following line should be displayed.

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

[servername].p12, Jan 8, 2007, PrivateKeyEntry,
Certificate fingerprint (MD5): 66:C1:4E:0D:B1:59:FB:4C:99:E8:1A:49:7D:F6:EF:32

The [servername].jks keystore can now be used by Tomcat or an application as a java keystore.

NOTE:  the keystore that you have created must contain only 1 certificate.

3.	Creating a server trust store for use with a server.

You must obtain the mitClient.cer (this is the MIT client CA V1 public key) and place it in the working directory.  You can get the mitClient.cer by going to http://ca.mit.edu/mitClient.crt  and save the certificate to your working directory as mitClient.cer. 

To create the server trust store, use the following command line:

keytool -import -keystore serverTrustStore.jks -alias mitClient -file mitClient.cer

When prompted for the keystore password, use a password that is well known to you.  Don’t forget this password because you will need it when configuring Tomcat or an application to use this keystore.  Answer yes the prompted for Trust this certificate? [no]:

The serverTrustStore,jks should now contains only the mitClient certificate.  You can verify this by using the following command line:

keytool -list -keystore serverTrustStore.jks

And you should get something similar to:

Your keystore contains 1 entry

mitClient, Aug 30, 2007, trustedCertEntry,
Certificate fingerprint (MD5): CF:41:AB:E1:03:6D:F8:21:37:55:62:C1:EF:18:71:96

4.  Using the keystores with Tomcat.

To use the keystores with Tomcat, change the following lines in the Tomcat’s server.xml file and change….

From:
<Connector port="8443"
maxHttpHeaderSize="8192"
maxThreads="150" 
minSpareThreads="25" 
maxSpareThreads="75"
enableLookups="false" 
disableUploadTimeout="true"
acceptCount="100" 
scheme="https" 
secure="true"
clientAuth="false" 
sslProtocol="TLS" />

TO:
<Connector port="8443" 
maxHttpHeaderSize="8192"
maxThreads="150" 
minSpareThreads="25" 
maxSpareThreads="75"
enableLookups="true"
disableUploadTimeout="true" 
acceptCount="100" 
scheme="https" 
secure="true" 
sslProtocol="TLS"
clientAuth="true" 
className="org.apache.catalina.connector.http.HttpConnector" 
keystoreFile="/path/to/keystore/[servername].jks"
keystorePass="changeit"
truststoreFile="/path/to/keystore/serverTrustStore.jks"
truststorePass="changeit"/>

In the above connector, the password for the [servername].jks and the serverTrustSore.jks is changeit.  Change the password to the password you used in 2) above.