The J2EETM Tutorial

Setting Up a Server Certificate

Certificates are used with the HTTPS protocol to authenticate Web clients. The HTTPS service of the J2EE server will not run unless a server certificate has been installed. Use the following procedure to set up a J2EE server certificate.

  1. Generate a key pair and a self-signed certificate.
    The keytool utility enables you to create the certificate. The keytool utility that ships with the J2EE SDK has the same syntax as the one that ships with the J2SE software. However, the J2EE SDK version programmatically adds a Java Cryptographic Extension provider that has implementations of RSA algorithms. This provider enables you to import RSA-signed certificates.
    To generate the certificate, run the keytool utility as follows, substituting <certificate-alias> with the alias of your certificate and <keystore-filename> with the name of your keystore file:
       keytool -genkey -keyalg RSA -alias <certificate-alias> 	
        -keystore <keystore-filename>
  2. The keytool utility prompts you for the following information:
    1. Keystore password: Enter a password. (You may want to use "changeit" to be consistent with the default password of the J2EE SDK keystore.)
    2. First and last name: Enter the fully qualified name of your server. This fully-qualified name includes the host name and the domain name.
    3. Organizational unit: Enter the appropriate value.
    4. Organization: Enter the appropriate value.
    5. City or locality: Enter the appropriate value.
    6. State or province: Enter the unabbreviated name.
    7. Two-letter country code: For the USA, the two-letter country code is US.
    8. Key password for alias: Do not enter a password. Press the Return key.
  3. Import the certificate.
    If your certificate will be signed by a CA other than Verisign, you must import the CA certificate. Otherwise, you may skip this step. (Even if your certificate will be signed by Verisign Test CA, you must import it.)
    To import the certificate, perform these tasks:
    1. Request the CA certificate from your CA. Store the certificate in a file.
    2. To install the CA certificate in the Java 2 Platform, Standard Edition, run the keytool utility as follows. (You must have the required permissions to modify the $JAVA_HOME/jre/lib/security/cacerts file.)
           keytool -import -trustcacerts -alias <ca-cert-alias> 	
            -file <ca-cert-filename>
  4. If you want to have your certificate digitally signed by a CA, do the following:
    1. Generate a Certificate Signing Request (CSR).
           keytool -certreq -sigalg MD5withRSA -alias <cert-alias> 	
            -file <csr-filename>
    2. Send the contents of the <csr-filename> for signing. If you are using Verisign CA, go to Verisign will send the signed certificate via e-mail. Store this certificate in a file.
    3. Import the signed certificate that you received in email into the server:
           keytool -import -alias <cert-alias> -file