COMODO SSL certificate on Jboss7

java, jboss7.x, ssl

Solution

I finally managed to get the installation right! Here's how you do it:

Install the COMODO certificates into your keystore wit this command:

keytool -import -trustcacerts -alias <filename> -file <filename>.crt -keystore domain.keystore

in the following order:

» Root: AddTrustExternalCARoot.crt
» Intermediate 1: COMODOAddTrustServerCA.crt
» Intermediate 2: COMODOExtendedValidationSecureServerCA.crt

Then install your domain certificate:

keytool -import -trustcacerts -alias mykey -file yourDomainName.crt -keystore domain.keystore

You should use the same alias instead of mykey, that you used to generate your keystore. If you do everything correctly, you should get this output:

Certificate reply was installed in keystore

Anything else means, you probably didn't use the correct alias. The final thing you need to do is to modify your standalone.xml like this:

<connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true">
    <ssl name="<domain>-ssl" key-alias="<domain>" password="******" certificate-key-file="../standalone/configuration/<domain>.keystore"/>
</connector>

And you should be good to go!

Problem

I registered a domain and would like to set up SSL encryption for it. My domain provider offered me to get a SSL certificate from COMODO. I generated a key and a csr file using openSSL: ``` openssl req -nodes -newkey rsa:2048 -keyout myserver.key -out server.csr ``` The command produced a private key, myserver.key and the csr file. I uploaded the content of the csr to comodo, and after verification, they sent me the following files: ``` Root CA Certificate - AddTrustExternalCARoot.crt Intermediate CA Certificate - COMODORSAAddTrustCA.crt Intermediate CA Certificate - COMODORSADomainValidationSecureServerCA.crt Your PositiveSSL Certificate - mydomain.crt ``` I'm lost on where to go from here. I followed these instructions: https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/638/0/certificate-installation-java-based-web-servers-tomcat-using-keytool and created a domain.keystore file, but I'm not sure if that's the right thing to do or not. My configuration in Jboss now looks like this: ``` <connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true"> <ssl name="mydomain" password="*****" protocol="TLSv1" certificate-key-file="../standalone/configuration/domain.keystore"/> </connector> ``` But that doesn't seem to work. I get no error in the server log, the page simply times out. If i use http it works normally. Any advice? EDIT: I took a different approach, I generated my keystore in this way: ``` keytool -genkey -alias domain -keyalg RSA -keysize 2048 -keystore domain.keystore ``` then I uploaded the new csr info to comodo and got the three .crt certificates back. I imported them into the keystore with this command: ``` keytool -import -trustcacerts -alias domain -file domain.crt -keystore domain.keystore ``` and then I used the keystore in the standalone.xml in this way: ``` <connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true"> <ssl name="domain-ssl" key-alias="domain" password="******" certificate-key-file="../standalone/configuration/domain.keystore" protocol="TLSv1"/> </connector> ``` The server starts, but when I try to connect to it, my browser says that the connection is untrusted: ``` domain uses an invalid security certificate. The certificate is not trusted because it is self-signed. (Error code: sec_error_ca_cert_invalid) ```

Original source