How to add an SSL certificate to the server

In case a certificate changes, a server moves, …

First : download the certificate, I recommend using firefox to navigate to the url, clicking the security icon, view certificate → details → export.

on most of our servers :

sudo /usr/lib/jvm/jdk1.7.0/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -keystore /usr/lib/jvm/jdk1.7.0/jre/lib/security/cacerts

on finanzprofi server :

sudo /usr/lib/jvm/java-7-openjdk-amd64/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -alias inno201708 -keystore /usr/lib/jvm/java-7-openjdk-amd64/jre/lib/security/cacerts

on profiberatung server (apella/finakom) :

sudo /usr/lib/jvm/java-7-oracle/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -alias inno201708  -keystore /usr/lib/jvm/java-7-oracle/jre/lib/security/cacerts

on java6sun :

/etc/java-6-sun/security/cacerts

on our newest servers :

sudo /usr/lib/jvm/default-java/jre/bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -keystore /usr/lib/jvm/default-java/jre/lib/security/cacerts

password = changeit

It's possible you don't need to reïnitialize Tomcat if it has been configured to use the keystore.

First check which java installation you are using :

Netbeans : - Go to “services” In the tree open Servers. - Rightclick Tomcat select “properties”. - click manage platforms & copy the path to the java installation

example : /Library/Java/JavaVirtualMachines/jdk1.7.0_45.jdk/Contents/Home then use the following code

cd <PATH TO JAVA INSTALLATION>
sudo bin/keytool -importcert -trustcacerts -file ~/\*.innosystems.net -keystore lib/security/cacerts

add –alias RANDOMNAME

When multiple instances of tomcat are running, the cacerts cache will only renew when ALL of them are closed.
This is ofcourse NOT desirable so… as a quick fix you can tell tomcat, to use the file it should be using anyways :

-Djavax.net.ssl.trustStore=/usr/lib/jvm/jdk1.7.0/jre/lib/security/cacerts

this bypasses the incomprehensible caching feature of the java keystore.

Only if it was not already configured with keystore. Rule of thumb : test before restart