Generating the SSL certificate and importing it to the keystore

An important prerequisite for secure communication between the web browser (end-user) and the web server is to use Secure Sockets Layer (SSL) certificate. This document discusses the steps to generate and import the SSL certificate to the keystore. This certificate is required for configuring SSL in the Kubernetes Ingress Controller (if in use as a front-end for Webapp Gateway) or the Webapp Gateway microservice. 

Steps to generate SSL certificate

1. Open Powershell**.**

2. Run the following Keytool command to create a Keystore for Jetty with a self-signed certificate or CA signed certificate. In case Keytool is not installed on your system, install it by referring to the tool documentation.

   [+] For self-signed certificate

   [-] Hide

   To generate SSL certificate for Jetty with a self-signed certificate:

   Where,

   <keyalg> specifies the algorithm to be used to generate a key pair.

   <alias_name> is a unique string to identify the Keystore.

   <keystore_name> is the location and filename where you want to store the generated key.

   <password> is the password to protect the private key of the generated key pair, default is changeit.

   <days> are the number of days the certificate will expire.

   <keysize> specifies the size of each key to be generated.

   <FQDN/IP of the Gateway> is the IP address or FQDN of the Webapp Gateway.

   <domain_name> is the name of the domain you are using. It is not necessary to use the domain name in the command above. However, for easy identification, it is recommended to use the domain name.

   For example*,*

   keytool -genkey -keyalg RSA -alias selfsigncert -keystore certs.jks -storepass changeit -validity 365 -keysize 2048 -ext san=ip:10.44.2.59

   keytool -genkey -keyalg RSA -alias selfsigncert -keystore certs.jks -storepass changeit -validity 365 -keysize 2048 -ext san=dns:localhost

   [+] For CA signed certificate

   [-] Hide

   To generate SSL certificate for Jetty with a CA signed certificate:

   1. Generate Keystore

      Where,           

      <keyalg> specifies the algorithm to be used to generate a key pair.

      <alias_name> is a unique string to identify the Keystore.

      <keystore_name> is the location and filename where you want to store the generated key.

      <password> is the password to protect the private key of the generated key pair, default is changeit.

      <days> are the number of days the certificate will expire.

      <keysize> specifies the size of each key to be generated.

      For example,

      keytool -genkey -keyalg RSA -alias server -keystore certs.jks -storepass changeit -validity 365 -keysize 2048

      If you are using multiple domain names for the same certificate then you need to use SAN (Subject Alternative Name) while generating Keystore.

      Where, <FQDN/IP of the Webapp Gateway> is the IP address or FQDN of the Webapp Gateway.
      This command generates JKS file.

   2. Generate CSR from the generated Keystore
      Run the following Keytool command to create a Certificate Signing Request (CSR).

      This command will generate a <domainname>.csr file to sign from CA.

   3. If you are using multiple domain names for the same certificate then you need to use SAN (Subject Alternative Name) while generating CSR for the Keystore.

      Send this CSR to your CA to generate an SSL certificate. After your SSL certificate is generated, you need to import the certificate in the Java Keystore.

   4. Import CA Signed SSL Certificate into Java Keystore.   

      You might get multiple SSL certificates from your CA. You need to import all these SSL certificates into your Keystore. Ensure that you use the same Keystore that is used in generating CSR while importing SSL certificates.

      1. Import Trusted Root certificate into Java Keystore.

      2. Import Intermediate certificate into Java Keystore.

      3. Import domain certificate into Java Keystore

         Where,

         <certificate_name> is the name of the CA certificate.

         <domain_name> is the name of the domain you are using.

   While executing the command, you will be prompted to provide other details. The default password is password. You can change the password. Note the Keystore password for future references.