...
Note that updating the key- or trust stores requires a server restart as they are read on start-up.
| Code Block |
|---|
$ keytool -genkey -alias broker \
-keyalg RSA \
-keystore broker.ks # Generate broker certificate and key
$ keytool -export -alias broker \
-keystore broker.ks \
-file broker_cert # Export certificate for import into client trust store
$ keytool -genkey -alias client \
-keyalg RSA \
-keystore client.ks # Generate client key and certificate
$ keytool -import -alias broker \
-keystore client.ts \
-file broker_cert # Import server certificate in client trust store
$ keytool -export -alias client \
-keystore client.ks \
-file client_cert # Export client certificate for server trust store
$ keytool -import -alias client \
-keystore broker.ts \
-file client_cert # Import client certificate in server trust store
|
At present using the java keytool to generate and manage keys is preferable (for tests!) as it can be tricky to manage the interplay with the openssl implementation. However the below commands should be usable to convert openssl type keys to something usable with the Java keystore.
| Code Block |
|---|
# Import client certificate+key to client
$ openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12
$ keytool -importkeystore -srckeystore client.p12 -srcstoretype pkcs12 -destkeystore client.ks -storepass <pass>
# Import server certificate to client
$ keytool -import -alias broker -keystore client.ks -file ca.crt
# Import client key to server
$ openssl x509 -in client.pem -out client.der -outform der
$ keytool -importcert -alias client -keystore broker.ks -storepass <pass> -file client.der
|