How to import an existing paid wildcard ssl cert directly into tomcat on ubuntu?

[Paul Cope]

We have recently been cut off from emails from O365 due to basic auth being shut down and now requiring OAuth enabled.

I'm trying to add an already generated domain wildcard cert directly into Tomcat keystore but cannot find any commands to do it.

Can anyone help as support has just washed their hands of supporting anything to do with getting SSL working with their product?

[Alexis Robert · Accepted solution]

Hi @Paul Cope , 

you will actually import the SSL cert in the JVM used to run Tomcat, not in Tomcat itself.

The documentation from Atlassian describes how to do this using the "keytool" command : https://confluence.atlassian.com/kb/how-to-import-a-public-ssl-certificate-into-a-jvm-867025849.html

Let me know if this helps, 

--Alexis

[Paul Cope]

I imported the wildcard.cer then added the required changes to the server.xml adding the 8443 ssl details. 

Restarted the server and ssl isn’t loading via the https:// url using port 8443

 Went into config.sh and it is giving the following error when checking the configured ssl encryption

"The referenced certificate could not be found or accessed."

[Paul Cope]

I listed the alias jira in the keystone and it returns the certificate fingerprint

[Artur Moura]

Hey @Paul Cope

Per your description, it seems you don't have the private key that matches the public certificate.

Since you have a wildcard certificate, I assume you should have a PFX file that you use on other web servers.

To try to make things easier, I suggest you refer to this How to run JIRA over HTTPS with a Personal Information Exchange (PFX) Certificate KB to set up Jira to use SSL using PFX instead of a Java KeyStore.

Hoping it helps, please let us know how it goes.

[Paul Cope]

I have followed that guide but im a bit lost where it asks for the "keyalias"

I have tried using the issued name and SAN and nothing works.

[Paul Cope]

In the guide it says "Notice that the keyAlias parameter is not always 1. Every key has a different keyAlias."

How do I find what KeyAlias is on the cert I'm using?

[Artur Moura]

Hey @Paul Cope

You should find the *KeyAlias* by running the following command.

keytool -v -list -storetype PKCS12 -keystore <wildcard.pfx>

[Paul Cope]

Your a star, after finding the alias and updating the server.xml with that I can now access over https://

Thanks a lot for taking the time to help me with this.

Paul

[Artur Moura]

You are very welcome @Paul Cope :D 

Glad to know it worked!