17

I want to create certificate chain in java as follows:

ca.mycompany.com
|--asia.mycompany.com
   |--india.mycompany.com

where ca.mycompany.com is a root certificate (self signed).

I know this is possible with OpenSSL. But is it possible to to achieve this with keytool?

If not, can I achieve this with Mozilla NSS library?

Tamal Kanti Nath
  • 914
  • 2
  • 10
  • 18

2 Answers2

32

There is an example in the keytool documentation that shows how to do this: 

keytool -genkeypair -keystore root.jks -alias root -ext bc:c
keytool -genkeypair -keystore ca.jks -alias ca -ext bc:c
keytool -genkeypair -keystore server.jks -alias server

keytool -keystore root.jks -alias root -exportcert -rfc > root.pem
keytool -storepass <storepass> -keystore ca.jks -certreq -alias ca | keytool -storepass <storepass> -keystore root.jks -gencert -alias root -ext BC=0 -rfc > ca.pem

cat root.pem ca.pem > cachain.pem
keytool -keystore ca.jks -importcert -alias ca -file cachain.pem

keytool -storepass <storepass> -keystore server.jks -certreq -alias server | keytool -storepass <storepass> -keystore ca.jks -gencert -alias ca -ext ku:c=dig,keyEncipherment -rfc > server.pem
cat root.pem ca.pem server.pem > serverchain.pem
keytool -keystore server.jks -importcert -alias server -file serverchain.pem

You can also generate certificate chains pretty easily with KeyStore Explorer:

  1. Create a new key pair, which implies creating a self-signed certificate (the root CA).
  2. Right click on root CA certificate and select "Sign New Key Pair", this creates the sub CA certificate and key pair.
  3. Right click on sub CA certificate and select "Sign New Key Pair" again.

Signing a new certificate

The resulting chain:

enter image description here

Omikron
  • 4,072
  • 1
  • 27
  • 28
  • Step 6 of your instructions gives me `keytool error: java.lang.Exception: Failed to establish chain from reply` – Stewart Dec 25 '17 at 19:06
  • @Stewart Those are not _my_ instructions, they are copied from the official keytool documentation (s. link in my answer). Anyway, I have fixed the problem. – Omikron Dec 25 '17 at 21:20
  • I see what you've done. The Root and the CA imported together as a chain. – Stewart Dec 26 '17 at 08:34
4

This is a perfect tutorial which help you go though the process of creating certificate chain using keytool. Basically, the process is you need to sign the certificate with the keys from CA and then install the certificate to the keystore you create.

PixelsTech
  • 3,229
  • 1
  • 33
  • 33