SSL Certificates: From CSR to a JKS storage

I have started doing this quite a lot these days so I’d better put a post up here to get rid of all the Google searching 🙂 It’s not that complicated but I know I will forget if I don’t do it for a while.

Let’s start with creating the CSR
First we create a key

openssl genrsa -out domain.com.key 2048

This will create a private key called domain.com.key and with a key size of 2048 bits

Now it’s time to create the CSR

openssl req -new -sha256 -key domain.com.key -out domain.com.csr

When creating a CSR you need to input some details about the site/organisation that are going to use the certificate, eg.:

Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:my.domain.name
Email Address []:admin@domain.name

Out of these questions there is one that is CRUCIAL and that is the Common Name. For an SSL certificate this HAS to be the domain name with or without a subdomain that the certificate is going to be valid for, so if the URL that is called my.domain.com the Common Name should be “my.domain.com” and if it is called domain.com the Common Name should be “domain.com”

After these questions have been answered the openssl program creates a CSR file called domain.com.csr that we can send to our certificate supplier (DigiCert/Go-Daddy/Amazon and many others). The supplier will then get back to us with a certificate, root certificate and maybe some intermediate certificates

When we have received the certificates from our supplier it is time to start assembling the signed key .p12 file. For this we use the domain.crt (supplier) and domain.com.key_nopasswd (same key we created in the beginning) files.

First we remove any password from the key file (depending on application this might not always be necessary)

openssl rsa -in domain.com.key -out domain.com.key_nopasswd

You will be prompted for the password of your .key file

Once the key file is without a password we can create the .p12 file

openssl pkcs12 -export -name somename -in domain.crt -inkey domain.com.key_nopasswd -out keystore.p12

Now we have the .p12 file. Time to put it into the jks container

keytool -importkeystore -destkeystore mykeystore.jks -srckeystore keystore.p12 -srcstoretype pkcs12 -alias somealias

Lastly we need the CA and any intermediate certificates (one command run per certificate file)

keytool -import -keystore mykeystore.jks -file someca.crt -alias someotheralias

The jks is now ready for use!

Tested on Ubuntu 16.04 (AWS) and Play Framework 2.3

Leave a Comment


NOTE - You can use these HTML tags and attributes:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> <pre lang="" line="" escaped="" cssfile="">

This site uses Akismet to reduce spam. Learn how your comment data is processed.