Differences
This shows you the differences between two versions of the page.
|
java:ssl [30/05/2014 12:49] Anthony Arents [Mac : Tomcat in netbeans] |
java:ssl [23/10/2018 15:07] (current) Anthony Arents [Use the keytool tool in the JDK] |
||
|---|---|---|---|
| Line 8: | Line 8: | ||
| on most of our servers : | on most of our servers : | ||
| - | <code bash>/usr/lib/jvm/jdk1.7.0/jre/bin/keytool -importcert -file ~/\*.innosystems.net -keystore /usr/lib/jvm/jdk1.7.0/jre/lib/security/cacerts</code> | + | <code bash>sudo /usr/lib/jvm/jdk1.7.0/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -keystore /usr/lib/jvm/jdk1.7.0/jre/lib/security/cacerts</code> |
| + | |||
| + | on finanzprofi server : | ||
| + | <code bash>sudo /usr/lib/jvm/java-7-openjdk-amd64/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -alias inno201708 -keystore /usr/lib/jvm/java-7-openjdk-amd64/jre/lib/security/cacerts</code> | ||
| + | |||
| + | on profiberatung server (apella/finakom) : | ||
| + | <code bash>sudo /usr/lib/jvm/java-7-oracle/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -alias inno201708 -keystore /usr/lib/jvm/java-7-oracle/jre/lib/security/cacerts</code> | ||
| on java6sun : | on java6sun : | ||
| <code bash>/etc/java-6-sun/security/cacerts</code> | <code bash>/etc/java-6-sun/security/cacerts</code> | ||
| - | password = changeit | ||
| + | on our newest servers : | ||
| + | <code bash>sudo /usr/lib/jvm/default-java/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -keystore /usr/lib/jvm/default-java/jre/lib/security/cacerts</code> | ||
| + | on MAC osX : | ||
| + | <code bash>sudo /Library/Java/JavaVirtualMachines/jdk1.8.0_181.jdk/Contents/Home/jre/bin/keytool -importcert -trustcacerts -file ~/Desktop/mobi.crt -keystore /Library/Java/JavaVirtualMachines/jdk1.8.0_181.jdk/Contents/Home/jre/lib/security/cacerts</code> | ||
| + | |||
| + | ''password = changeit''\\ | ||
| + | \\ | ||
| + | It's possible you don't need to reïnitialize Tomcat if it has been configured to use the keystore. | ||
| ===== Mac : Tomcat in netbeans ===== | ===== Mac : Tomcat in netbeans ===== | ||
| Line 27: | Line 40: | ||
| example : /Library/Java/JavaVirtualMachines/jdk1.7.0_45.jdk/Contents/Home | example : /Library/Java/JavaVirtualMachines/jdk1.7.0_45.jdk/Contents/Home | ||
| then use the following code | then use the following code | ||
| - | '' | + | <code bash>cd <PATH TO JAVA INSTALLATION> |
| - | sudo bin/keytool -importcert -file ~/\*.innosystems.net -keystore lib/security/cacerts'' | + | sudo bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -keystore lib/security/cacerts</code> |
| - | ===== No permission ===== | + | |
| - | + | ||
| - | Use sudo ! | + | |
| ===== certificate already exists with that key ===== | ===== certificate already exists with that key ===== | ||
| Line 37: | Line 47: | ||
| add --alias RANDOMNAME | add --alias RANDOMNAME | ||
| + | |||
| + | ===== ! PRODUCTION ===== | ||
| + | |||
| + | When multiple instances of tomcat are running, the cacerts cache will only renew when ALL of them are closed. \\ | ||
| + | This is ofcourse NOT desirable so... as a quick fix you can tell tomcat, to use the file it should be using anyways : | ||
| + | |||
| + | ''-Djavax.net.ssl.trustStore=/usr/lib/jvm/jdk1.7.0/jre/lib/security/cacerts'' | ||
| + | |||
| + | this bypasses the incomprehensible caching feature of the java keystore. | ||
| ===== Last STEP : Tomcat restart ===== | ===== Last STEP : Tomcat restart ===== | ||
| + | |||
| + | Only if it was not already configured with keystore. Rule of thumb : test before restart | ||