====== How to add an SSL certificate to the server ======

In case a certificate changes, a server moves, ...

First : download the certificate, I recommend using firefox to navigate to the url, clicking the security icon, view certificate -> details -> export.

===== Use the keytool tool in the JDK =====

on most of our servers :
<code bash>sudo /usr/lib/jvm/jdk1.7.0/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -keystore /usr/lib/jvm/jdk1.7.0/jre/lib/security/cacerts</code>

on finanzprofi server :
<code bash>sudo /usr/lib/jvm/java-7-openjdk-amd64/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -alias inno201708 -keystore /usr/lib/jvm/java-7-openjdk-amd64/jre/lib/security/cacerts</code>

on profiberatung server (apella/finakom) :
<code bash>sudo /usr/lib/jvm/java-7-oracle/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -alias inno201708  -keystore /usr/lib/jvm/java-7-oracle/jre/lib/security/cacerts</code>

on java6sun :
<code bash>/etc/java-6-sun/security/cacerts</code>


on our newest servers :
<code bash>sudo /usr/lib/jvm/default-java/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -keystore /usr/lib/jvm/default-java/jre/lib/security/cacerts</code>

on MAC osX :
<code bash>sudo /Library/Java/JavaVirtualMachines/jdk1.8.0_181.jdk/Contents/Home/jre/bin/keytool -importcert -trustcacerts -file ~/Desktop/mobi.crt -keystore /Library/Java/JavaVirtualMachines/jdk1.8.0_181.jdk/Contents/Home/jre/lib/security/cacerts</code>

''password = changeit''\\
\\
It's possible you don't need to reïnitialize Tomcat if it has been configured to use the keystore.
===== Mac : Tomcat in netbeans =====

First check which java installation you are using :

Netbeans : 
- Go to "services" In the tree open Servers. 
- Rightclick Tomcat select "properties".
- click manage platforms & copy the path to the java installation

example : /Library/Java/JavaVirtualMachines/jdk1.7.0_45.jdk/Contents/Home
then use the following code
<code bash>cd <PATH TO JAVA INSTALLATION>
sudo bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -keystore lib/security/cacerts</code>

===== certificate already exists with that key =====

add --alias RANDOMNAME


===== ! PRODUCTION =====

When multiple instances of tomcat are running, the cacerts cache will only renew when ALL of them are closed. \\ 
This is ofcourse NOT desirable so... as a quick fix you can tell tomcat, to use the file it should be using anyways :

''-Djavax.net.ssl.trustStore=/usr/lib/jvm/jdk1.7.0/jre/lib/security/cacerts''

this bypasses the incomprehensible caching feature of the java keystore.

===== Last STEP : Tomcat restart =====

Only if it was not already configured with keystore. Rule of thumb : test before restart