Problem in importing a cert and a pvt key

glow007....

I guess you sent a request to a CA. And the CA sent

you back the response that had their certificate

(enclosing their public key) and included their

signature that they used to sign your public key.

Right ?

-Right

I have created the CSR and the private using openssl..and I have got the signed certificate from Thawte.

Now I need to import this certificate into my keystore.

So that I can send it to one of my servers which requires client's certificate.

glow007 at 2007-6-29 17:35:11 >

Well, what kind/type of keystore is the private key file (the .pvt file) that is used in production ?

I would guess there would be a provider matching that keystore type. i.e. a provider string name and a service provider implementation (Java classes or jar file etc.) Right ?

Then from your client-side application, you can get a handle to the corresponding key store using ava.security.KeyStore.getInstance(String type, String provider) Right ?

neville_sequeira at 2007-6-29 17:35:11 >

Hi, Did you ever solve this problem?

I am dealing with the same issue.

I have a private key generated quite some time ago by openssl and used in apache ssl. Now, I have a need for this key in the jks keystore file. There seems to be no easy way to achieve this.

> Thank you very much!!..

>

> I have the client.key which has the private key

>

> and I have the client.crt which has the certificate

> signed by Thawte in Base64 Encoded format

>

> Now I need to import this into the keystore..

> So, that I can send the certificate when the server

> asks for it...

>

>

alted at 2007-6-29 17:35:11 >

I finally got an externally generated private key into tomcats keystore, and this is how:-

First, go here and download the ImportKey java code:-

http://www.comu.de/docs/tomcat_ssl.htm

Change the source code so that the password is not "" (I've defaulted it to 'changeit', which tomcat uses. If you leave it blank, it causes problems later trying to change it.

Next, get a copy of OpenSSL. You can get this from openssl.org and compile it yourself, or do what I did and search google for precompiled binaries.

Get the private key that you used to generate your CSR file.

Convert the key (we use the openssl):

openssl pkcs8 -topk8 -nocrypt -in PRIVATE.KEY -out PRIVATE.KEY.der -outform der

Get the cert issued by your CA. Even if its a chained cert, tomcat does NOT need the root cert using this method.

Convert the certificate:

openssl x509 -in YOUR.CERT -out YOUR.CERT.der -outform der

Run java ImportKey using:-

java comu.ImportKey PRIVATE.KEY.der YOUR.CERT.der tomcat

Rename the file in your home directory from ImportKey.keystore to .keystore (need to use dos to do this on a windows box)

Then change the keypasswd to 'changeit' using:-

keytool -keypasswd -new changeit -alias tomcat

The java code warns that this method WILL overwrite your existing keystore, but by default, it outputs a file called ImportKey.keystore, not .keystore.

Enjoy

evilb69 at 2007-6-29 17:35:11 >

tunacat -

I used this method to import both the signed server cert and the root ca cert (chained together), and the server private key (all in .pem format) into a pkcs12 format keystore. It works, and I can use the keystore - but the root ca cert doesn't seem to be found when performing authentications. Do I need to add the root ca cart to a default keystore perhaps?

TIA,

Rich

rmfought at 2007-6-29 17:35:11 >

here is another way to import a private key with a certificate generated by openssl utility.

Use BouncyCastle security provider's jar bcprov-jdk13-128.jar with the following program:

import java.security.InvalidKeyException;

import java.security.KeyFactory;

import java.security.KeyStore;

import java.security.KeyStoreException;

import java.security.NoSuchAlgorithmException;

import java.security.PrivateKey;

import java.security.cert.Certificate;

import java.security.cert.CertificateException;

import java.security.cert.CertificateFactory;

import java.security.cert.X509Certificate;

import java.security.spec.EncodedKeySpec;

import java.security.spec.InvalidKeySpecException;

import java.security.spec.PKCS8EncodedKeySpec;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileOutputStream;

class ImportPrivateKey {

// need org.bouncycastle.jce.provider.BouncyCastleProvider

static {

try {

if (java.security.Security.getProvider("BC") == null) {

java.security.Security.addProvider((java.security.Provider)Class.forName("org.bouncycastle.jce.provider.BouncyCastleProvider").newInstance());

}

} catch (Throwable t) {

throw new RuntimeException(t);

}

}

public static void main(String args[]) throws Exception {

if (args.length != 6) {

System.out.println("usage: keystoreFile keyStorePasswd alias aliasPasswd privateKeyFile certFile");

return;

}

String keyStoreFile = args[0];

String keyStorePasswd = args[1];

String alias = args[2];

String aliasPasswd = args[3];

String privateKeyFile = args[4];

String certFile = args[5];

EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(readBytesFromFile(privateKeyFile));

KeyFactory keyFactory = KeyFactory.getInstance("RSA");

PrivateKey privateKey = keyFactory.generatePrivate(keySpec);

CertificateFactory certFactory = CertificateFactory.getInstance("X.509");

Certificate[] certChain = (Certificate[]) certFactory

.generateCertificates(new FileInputStream(certFile))

.toArray(new Certificate[] {});

KeyStore keyStore = KeyStore.getInstance("jks");

if (!new File(keyStoreFile).exists()) {

keyStore.load(null, keyStorePasswd.toCharArray());

keyStore.store(new FileOutputStream(keyStoreFile), keyStorePasswd.toCharArray());

} else {

keyStore.load(new FileInputStream(keyStoreFile), keyStorePasswd.toCharArray());

}

keyStore.setKeyEntry(alias, privateKey, aliasPasswd.toCharArray(), certChain);

keyStore.store(new FileOutputStream(keyStoreFile), keyStorePasswd.toCharArray());

}

public static byte [] readBytesFromFile(String fileName) throws Exception {

File file = new File(fileName);

byte [] bytes = new byte[(int) file.length()];

new FileInputStream(file).read(bytes);

return bytes;

}

}

Yevgeny_Rouban at 2007-7-1 11:08:06 >