This process is in 3 basic parts.
1 - Create the Keystore
2 - Generate the CSR
3 - Import the cert
The documentation below has several methods to complete this process. The first is a how to use a free Java gui tool called Portecle, the second is another free
tool called Keystore Explorer and finally the command line method.
*We do not recommend using the command line method unless you have done it before, it is easy to do something wrong.
**If you do not feel comfortable with either method, or it has been a while since you have updated your keystore yourself, please see the following KB on how Stoneware can assist you with updating your keystore:
### ###
### ###
### ###
### KeyStore Explorer method 5.x ###
### ###
Found at : http://keystore-explorer.sourceforge.net/ which is now free.
Load gui, create a new JKS keystore.
Next, generate a new KeyPair, selecting RSA / 2048
Version : 3
Signature Algorithm : SHA-256 with RSA
Validity Period 5 Years
Serial Number : leave at default
Name : < click edit name icon >
Fill out the information for the keystore.
cn: *.example-cloud.com
ou: IT Services
o: company
l: Ft. Wayne
st: IN
C: US
E: ssladmin@example-cloud.com
*** Note the state should be un uppercase.
Click OK
Alias: *.example-cloud.com
Password: Same as your relay user password
Right click on *.example-cloud.com and choose generate CSR.
Format : PKCS #10
Signature Algorithm : SHA-256 with RSA (or whatever your CA vendors requests it should be)
Challenge : < leave blank >
CSR File : Enter name to save csr file.
This is the csr you will send to your Certificate Authority.
When you get your cert back, open internet explorer and go to :
Tool
Internet Options
Content
Certificates
Import
Select the certificate you were sent from your CA (save in Other People).
Once imported, export it as a .p7b file with the include any intermediate certificates option.
Go back to the keytool gui and right click on *.example-cloud.com and select Import CA Reply.
Save certificate and copy to relay to test.
### ###
### Command line Keytool method ###
### ###
### Part 1 ###
Note: This method is not recommended if you are not already familiar with using the command line for modifying SSL Certificates.
Backup your /usr/stoneware/jre/lib/security/cacerts file.
Go into webadmin, find your relay object , click on it, and take note of
where your stoneware.keystore file is located. Typically this is in
/usr/stoneware/config or /usr/stoneware/bin
Backup the stoneware.keystore file.
You will need to know the password for the RelayUser account as this is the same
password that is used for the stoneware.keystore.
Generate a Java keystore and key pair
keytool -genkey -alias mydomain -keyalg RSA -keystore stoneware.keystore -keysize 2048
Generate a certificate signing request (CSR) for an existing Java keystore
keytool -certreq -alias mydomain -keystore stoneware.keystore -file mydomain.csr
Import a root or intermediate CA certificate to an existing Java keystore
keytool -import -trustcacerts -alias root -file Thawte.crt -keystore stoneware.keystore
Import a signed primary certificate to an existing Java keystore
keytool -import -trustcacerts -alias mydomain -file mydomain.crt -keystore stoneware.keystore