All geek questions in one place

How to remove only one certificate from a certificate chain in a Java keystore

I have a Tomcat server with a certificate chain for HTTPS stored in a Java keystore. The chain includes a self-signed root CA certificate. Although this seems to be normal, the TLS specification , some validation services warn about this, and it's probably best to leave it out .

How can I edit the keystore to remove only the self-signed root CA certificate, but leave the rest of the chain and private key intact?

+4
source share
1 answer

JKS PKCS12 ( ):

keytool -importkeystore -srckeystore old.jks -destkeystore old.p12 -deststoretype pkcs12

PEM PKCS12:

openssl pkcs12 -in old.p12 -out pemfile.pem -nodes

pemfile.pem ( " " ).

PEM PKCS12. cert/key , . "tomcat", .

openssl pkcs12 -export -in pemfile.pem -name tomcat -out new.p12

, PKCS12 JKS:

keytool -importkeystore -srckeystore new.p12 -destkeystore new.jks -srcstoretype pkcs12

new.jks - , .

+6

Source: https://habr.com/ru/post/1598125/

More articles:


All Articles