在Glassfish应用服务器中导入SSL证书

Question

I am trying to enable SSL on a project on Netbeans IDE and using Glassfish application Server.

For the SSL; i followed the procedure below.

1. Generated a keystore > keytool -genkey -alias client_keystore -keyalg RSA -keystore client_keystore.jks -keysize 2048
2. Generated a CSR > keytool -certreq -alias client_keystore -file yourcsrname.csr -keystore client_keystore.jks
3. Submitted the CSR to another party.
4. Received three .pem certificates from the party. I converted the .pem to .crt as openssl x509 -outform der -in your-cert.pem -out your-cert.crt
5. Importing the certs to my keystore as below;

keytool -import -trustcacerts -alias intermediate -file GoDaddy_Intermediate.crt -keystore client_keystore.jks

keytool -import -trustcacerts -alias root -file GoDaddy_Root.crt -keystore client_keystore.jks

keytool -import -trustcacerts -alias BizSwitch -file BizSwitch.crt -keystore client_keystore.jks

6. Import the keystore to the default glassfish keystore > keytool -importkeystore -srckeystore ~/Downloads/ipay/client_keystore.jks -destkeystore keystore.jks
7. Restarted glassfish server.

I am not sure if that's all but I am getting the sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target exception.

On restarting, from the glassfish logs I do not see the certificates being loaded as well.

Am I missing something?

Answer 1

Is your keystore in the folder /domains/domain1/config?

Looks like glassfish does not point to the correct keystore, as you correctly imported the certs.

Answer 2

Yous should also import the cert into the JVM's truststore...

Reference: Resolving javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed Error?

Answer 3

You created the keypair entry under alias client_keystore so you need to import your server cert to that alias and entry . Assuming BizSwitch is your server's name, you need to -importcert -file BizSwitch.crt -alias client_keystore -keystore client_keystore.jks . If you get it correct the output from that command should be Certificate reply was installed NOT Certificate was added . (The latter is correct for separate CA certs, but not the server cert.)

Also, you didn't need to convert to DER. keytool (or more exactly CertificateFactory ) has been able to read PEM certs for more than a decade, and even PEM-with-comments since j7 circa 2012. (This is not the case for some other crypto objects like private keys.)