How to generate a CSR in Tomcat with Keytool

Create a New Keystore

You will need to create a new Keystore, this is done by this command:

When the commands ask for the firstname and lastname, please type domainname.prefix instead of you name, else the certificate will issues to you name, instead of the domain name.

Generate a CSR from Your New Keystore

1. Next, you need to generate a CSR file, this is done by this command
   
   Shell

   keytool -certreq -alias domainname.prefix -file certreq.cer -keystore /path/domainname.prefix.jks

   1	keytool -certreq -alias domainname.prefix -file certreq.cer -keystore /path/domainname.prefix.jks

2. Type the keystore password that you chose earlier and hit Enter.
3. Please upload the certreq.cer, to you standard certificate supplier.

Installing the SSL Certificates to the Keystore

1. You will then get a certificate, save it as signcert.cer
2. Download aswell the correct intermediate certificate, aswell as the correct root certificate.
3. Import them with this command:
   
   Shell

   keytool -import -trustcacerts -alias root -file root.cer -keystore /path/domainname.prefix.jks keytool -import -trustcacerts -alias intermediate -file intermediate.cer -keystore /path/domainname.prefix.jks

   1 2 3

   keytool -import -trustcacerts -alias root -file root.cer -keystore /path/domainname.prefix.jks   keytool -import -trustcacerts -alias intermediate -file intermediate.cer -keystore /path/domainname.prefix.jks

4. Import the signed certificate
   
   Shell

   keytool -import -trustcacerts -alias domainanme.prefix -file signcert.cer -keystore /path/domainname.prefix.jks

   1	keytool -import -trustcacerts -alias domainanme.prefix -file signcert.cer -keystore /path/domainname.prefix.jks

Configuring your SSL Connector

Before Tomcat can accept secure connections, you need to configure an SSL Connector.

1. In a text editor, open the Tomcat server.xml file.
   The server.xml file is usually located in the conf folder of your Tomcat’s home directory.

2. Locate the connector that you want to use the new keystore to secure.
   Usually, a connector with port 443 or 8443 is used, as shown in step 4.

3. If necessary, uncomment the connector.
   To uncomment a connector, remove the comment tags (<!– and –>).

4. Specify the correct keystore filename and password in your connector configuration.

When you are done, your connector should look something like this:

Note: If you are using a version of Tomcat prior to Tomcat 7, you need to change “keystorePass” to “keypass”.

5. Save your changes to the server.xml file.
6. Restart Tomcat.