In case a certificate changes, a server moves, …
First : download the certificate, I recommend using firefox to navigate to the url, clicking the security icon, view certificate → details → export.
on most of our servers :
sudo /usr/lib/jvm/jdk1.7.0/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -keystore /usr/lib/jvm/jdk1.7.0/jre/lib/security/cacerts
on finanzprofi server :
sudo /usr/lib/jvm/java-7-openjdk-amd64/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -alias inno201708 -keystore /usr/lib/jvm/java-7-openjdk-amd64/jre/lib/security/cacerts
on profiberatung server (apella/finakom) :
sudo /usr/lib/jvm/java-7-oracle/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -alias inno201708 -keystore /usr/lib/jvm/java-7-oracle/jre/lib/security/cacerts
on java6sun :
/etc/java-6-sun/security/cacerts
on our newest servers :
sudo /usr/lib/jvm/default-java/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -keystore /usr/lib/jvm/default-java/jre/lib/security/cacerts
on MAC osX :
sudo /Library/Java/JavaVirtualMachines/jdk1.8.0_181.jdk/Contents/Home/jre/bin/keytool -importcert -trustcacerts -file ~/Desktop/mobi.crt -keystore /Library/Java/JavaVirtualMachines/jdk1.8.0_181.jdk/Contents/Home/jre/lib/security/cacerts
password = changeit
It's possible you don't need to reïnitialize Tomcat if it has been configured to use the keystore.
First check which java installation you are using :
Netbeans : - Go to “services” In the tree open Servers. - Rightclick Tomcat select “properties”. - click manage platforms & copy the path to the java installation
example : /Library/Java/JavaVirtualMachines/jdk1.7.0_45.jdk/Contents/Home then use the following code
cd <PATH TO JAVA INSTALLATION> sudo bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -keystore lib/security/cacerts
add –alias RANDOMNAME
When multiple instances of tomcat are running, the cacerts cache will only renew when ALL of them are closed.
This is ofcourse NOT desirable so… as a quick fix you can tell tomcat, to use the file it should be using anyways :
-Djavax.net.ssl.trustStore=/usr/lib/jvm/jdk1.7.0/jre/lib/security/cacerts
this bypasses the incomprehensible caching feature of the java keystore.
Only if it was not already configured with keystore. Rule of thumb : test before restart