One thing I’m doing very often and always searching on the Internet is how to obtain a self-signed SSL certificate and install it in both my client browsers and my local Tomcat.
Sure enough there are enough resources available online, but since it’s a bore to go looking for the right one (yes, some do not work), I figured let’s do it right once and document it so that it will always be there.
Create the keystore
Keystores are, guess what, files where your store your keys. In our case, we need to create one that will be used by both Tomcat and for the certificat generation.
The command-line is:
keytool -genkey -keyalg RSA -alias blog.frankel.ch -keystore keystore.jks -validity 999 -keysize 2048The parameters are as follow:
| Parameter | Value | Description |
|---|---|---|
-genkey |
Requests the keytool to generate a key.
For all provided features, type |
|
-keyalg |
RSA |
Wanted algorithm. The specified algorithm must be made available by one of the registered cryptographic service providers |
-keysize |
2048 |
Key size |
-validity |
999 |
Validity in days |
-alias |
blog.frankel.ch |
Entry in the keystore |
-keystore |
keystore.jks |
Keystore. If the keystore doesn’t exist yet, it will be created and you’ll be prompted for a new password; otherwise, you’ll prompted for the current store’s password |
Configure Tomcat
Tomcat’s SSL configuration is done in the ${TOMCAT_HOME}/conf/server.xml file.
Locate the following snippet:
<!--
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
-->Now, uncomment it and add the following attributes:
keystoreFile="/path/to/your/keystore.jks"keystorePass="Your password"
Note: if the store only contains a single entry, fine; otherwise, you’ll need to configure the entry’s name with keyAlias="blog.frankel.ch"
Starting Tomcat and browsing to https://localhost:8443/ will show you Tomcat’s friendly face. Additionnaly, the logs will display:
28 june 2011 20:25:14 org.apache.coyote.AbstractProtocolHandler init INFO: Initializing ProtocolHandler ["http-bio-8443"]
Export the certificate
The certificate is created from our previous entry in the keystore.
The command-line is:
keytool -export -alias blog.frankel.ch -file blog.frankel.ch.crt -keystore keystore.jksEven simpler, we are challenged for the keystore’s password and that’s all. The newly created certificate is now available in the filesystem. We just have to distribute it to all browsers that will connect to Tomcat in order to bypass security warnings (since it’s a self-signed certificate).
Spread the word
The last step is to put the self-signed certificate in the list of trusted certificates in Firefox.
For a quick and dirty way, import it in your own Firefox (Options → Advanced → Show certificates → Import…) and distribute the %USER_HOME%"/Application Data/Mozilla/Firefox/Profiles/xzy.default/cert8.db file.
It has to be copied to the %FIREFOX_HOME%/defaults/profile folder so that every single profile on the target machine is updated.
Note that this way of doing will lose previously individually accepted certificates (in short, we’re overwriting the whole certificate database).
For a more industrial process, look at the next section.