OpenSSL generates private key, request file, certificate import jks description

OpenSSL generates private key, request file, certificate import description

1. Generating the private key

OpenSSL genrsa-out Serverkey.key 1024/2048 This generates a private key without a password (after the KeyStore is generated, the password is changed to the same as the KeyStore password)

OpenSSL genrsa-des3-out Serverkey.key 1024/2048 This generates a password (the password must be the same as the KeyStore password that is generated later)

2. Generate the application file

OpenSSL Req-new-key serverkey.key-out CERT.CSR

Need to use the first step to generate the private key file Serverkey.key according to the prompts to fill in various information (some CA institutions may be required for certain field values, it will be required according to the requirements of the CA Agency)

3. Submit the application document to the CA certification body for the certificate

4. Generate the CA certificate chain (if the CA authority provides the CA certificate chain)

Rootca.cer, childca.cer two CA certificates

Server.cer CA Institutional approach to our certificate

OpenSSL x509-in Rootca.cer-text-noout

OpenSSL x509-in Childca.cer-text-noout

OpenSSL x509-in Server.cer-text-noout

Review the information below to see if the certificate can be viewed, and if an error occurs, convert the given certificate to a. Pem format

OpenSSL x509-in rootca.cer-inform der-out rootca.pem-outform PEM

OpenSSL x509-in childca.cer-inform der-out childca.pem-outform PEM

OpenSSL x509-in server.cer-inform der-out server.pem-outform PEM

CP Childca.pem CHAIN.PEM copy Childca.pem to Chain.pem

Cat Rootca.pem >> CHAIN.PEM Merge certificate (next)

OpenSSL verify-cafile Chain.pem SERVER.PEM Verification Certificate chain (if verify OK is displayed, the verification certificate chain is successful)

5. Convert User certificate to PKCS12

OpenSSL pkcs12-export-in server.pem-inkey serverkey.key-out server.pfx-cafile Chain.pem

6. Import the PKCS12 format certificate into the JKs KeyStore with Portecle

Convert to JKs (case sensitive) after opening server.pfx This format can change the password of the private key.

Right-click to rename alias, set password (must be same as JKs password)

Set the JKS password (must be the same as the key setting password)

Save As JKs file

7. Import the CA certificate into the Truststore with portecle

New KeyStore

Import the other CA certificate first (if it is a multi-level CA, first import the root CA, and so on), and then import the certificate that requires communication authentication, set the JKS password, save as JKS format file

OpenSSL generates private key, request file, certificate import jks description