Firstly when your issuance email arrives you will have two certificates in the email - your server certificate and a ChainedSSL CA certificate.
You must first export the certificates in der format as follows:
|
| 1. |
Copy the ChainedSSL CA certificate from your email and into a text editor such as notepad and save as chain.cer on a Windows machine with IE 5+.
|
| 2. |
Copy your web server certificate into a text editor such as notepad and save as yourdomain.cer on a Windows machine with IE 5+. |
| 3. |
Copy this root CA certificate into a text editor and save as root.cer on a Windows machine with IE 5+. |
| 4. |
Double-click the root.cer and select the Details tab, then Copy to File, then select the Base-64 option, give your copied certificate a file name of root_der.cer . |
| 5. |
Double-click the chain.cer and select Install. Choose "Place all certificates in following store" and select Intermediate Certification Authorities. Complete the Wizard. |
| 6. |
Double-click the chain.cer again and select the Details tab, then Copy to File, then select the Base-64 option, give your copied certificate a file name of chain_der.cer |
| 7. |
Double click the youdomain.cer and select the Details tab, then Copy to File, then select the PKCS#7 (p7b) option, also select the Include all certificates in the certification path , give your copied certificate a file name of yourdomain.p7b
|
The following certificate installations must be executed in the stated order.
|
| 1. |
Import the root_der.cer and chain_der.cer files using:
$ keytool -import -trustcacerts -keystore my.kdb -alias root - file root_der.cer $ keytool -import -trustcacerts -keystore my.kdb -alias root - file chain_der.cer
With my.kdb being your keystore. |
| 2. |
Import the yourdomain.p7b file using:
keytool -import -trustcacerts -keystore my.kdb -alias tomcat -file yourdomain.p7b
With my.kdb being your keystore. |
| Update server.xml configuration file: |
| 1. |
Open "$JAKARTA_HOME/conf/server.xml" in a text editor.. |
| 2. |
Find the following section:
<Connector
...
scheme="https"
secure="true"
keystoreFile="/pathto/my.kdb"
keystorePass="mypassword" |
| 3. |
If you want Tomcat to use the default SSL port, change all instances of the port number 8443 to 443. |
| 4. |
Add the keystoreFile and keystorePass directives to correspond with the keystore file and password that you are using |
| 5. |
Start or restart Tomcat using the appropriate startup script (startup.sh for unix/linux or startup.bat for windows) |
Test your certificate by connecting to your server.
Use the https protocol directive (e.g. https://your server/) to indicate you wish to use secure HTTP.
Note: The padlock icon on your Web browser will be displayed in the locked position if you have set up your site properly.
|
