tomcat 上的 SSL 带通配符证书

Question

. Answers to this question are eligible for a +100 reputation bounty. Learn more . Sidharth is looking for an .

I have an application which has to run on tomcat 7 on windows only, as my customer/client wants HTTPS implemented on tomcat.

I am able to run the tomcat on https with self-signed certificate.

But problem is client has told me that the "Known CA certificate" would be wildcard certificate, and i have to create a batch file which just takes one input, ie, the location of certificate and the script/batch should do the rest, no ROOT and INTERMEDIATE certificate would be provided, he said i have to extract it from the MAIN certificate which can be of any extension.

Is it possible to extract the root and intermediate certificate from the main certificate.

what would be the steps.

PS: I an new with SSL implementation

TIA

Answer 1

I'm not really sure what the exact use case is.

I can think of two possible cases:

• Your client wants to support client-side cert-based authentication. So they need to just provide a certificate file for each client which your script should automatically add to the truststore together with the extracted intermediate and root certificates.
• Your client wants to support multiple server certificates on the same server installation (eg multiple SSLHostConfig ) or on different installations. So they need a way to automate the server certificate configuration by just providing one server cert file to your script, which may again need to extract intermediate and root for sending to clients during https handshake.

Your question below can apply to both cases:

"Is it possible to extract the root and intermediate certificate from the main certificate."

The certificate can be provided by your client as a signle file in the following ways:

• A file containing multiple x509 PEM/DER certificates forming a certificate chain. eg the certificate itself, the intermediate and the root and possibly a private key.
• A keystore (JKS or P12) containing the above certificate chain and possibly a private key.
• A file containing a single PEM/DER certificate

Answer:

In the first two cases you can easily extract the intermediate and root certificates because they are contained inside that single file.

In the latter case the information contained in the certificate for the parent (eg intermediate certificate) is the Issuer: information which itself is not a certificate.
One possible way to fetch the issuer certificate in this case is by reading the CA Issuers link from the Authority Information Access (AIA) extension (if this is present in the certificate) and then fetching the certificate from there.

For trusting client-certificates your script should add the certificate and the (provided or fetched dynamically) intermediate and root to the truststore one by one.

For server-side certificate you need to form a chain containing intermediate and root (provided or fetched dynamically) and add this and the private key to the keystore.