The installation process differs slightly depending on the format of the certificate you received from a Certificate Authority.
1) PEM
If the certificate has been received in PEM format, you will need to add the CA root, CA intermediate, and certificate issued for your domain name in your keystore manually, in this order - starting from CA root and finishing with the certificate issued for your domain name.
Command for importation of a CA Root certificate to the keystore:
keytool -import -trustcacerts -alias root -file RootCA.crt -keystore yourkeystore.jks
Command for importation of a CA Intermediate certificate to the keystore:
keytool -import -trustcacerts -alias intermediate -file Intermediate.crt -keystore yourkeystore.jks
Important! If you received several intermediate certificates from the Certificate Authority, please import them one by one using different aliases.
Finally, you need to import the certificate issued for your domain name.
keytool -import -trustcacerts -alias tomcat -file yourcertificate.crt -keystore yourkeystore.jks
The alias for your domain certificate should be the same as the one you used when creating the keystore with the private key. If you did not specify the alias during the keystore creation, the default value will be 'mykey'.
1) PKCS7
If the certificate was received in PKCS7 format (usually it has *.cer or *.p7b extension), which includes the certificate issued for you domain with the CA certificates, you need import it in the keystore:
keytool -import -trustcacerts -alias tomcat -file yourcertificate.p7b -keystore yourkeystore.jks
If the certificate is imported successfully, and the keystore is completed, you should see the message:
“Certificate reply was installed in keystore”
To check the certificates which are added in the keystore run the command below:
keytool -list -keystore yourkeystore.jks -v
You should see details of the certificates imported into the keystore in the output:
0n screenshot the chain consists of 2 certificates: root and certificate signed by root, that was created for testing purposes. Nowadays usually chain has at least three certificates: root, intermediate and certificate signed by intermediate.
To review the certificates added to the keystore as a plain text run the following command:
keytool -list -rfc -keystore yourkeystore.jks
Once the the keystore is completed, you will need to describe it in the configuration of your tomcat.
Usually tomcat’s configuration file is named server.xml.
Open it as a plain text and create there a record like below:
<Connector port="443" protocol="HTTP/1.1"
SSLEnabled="true"
scheme="https" secure="true” clientAuth="false"
sslProtocol="TLS" keystoreFile="/your_path/yourkeystore.jks"
keystorePass="password_for_your_key_store" >
Restart tomcat to apply the changes and make the certificate work.
Congratulations! The certificate is now installed on the server for your site. The site should now be accessible via https://
After successful installation, you can check the cert was install correctly or not by following tools:
https://cryptoreport.websecurity.symantec.com/checker/views/certCheck.jsp
