Installation Guideline: SSL Certificates on Tomcat Server

SSL – Secure Socket Layer is a security Protocol. SSL Certificate is a digital signature. SSL Certificate is also known as Public Key Identity certificate. SSL is a protocol for securing communication between a web browser, and web server. Whenever you access a web server using https, the page you are sent is encrypted, and any information you send to that server is also encrypted

• Install Root CA Certificate

1) Download your SSL Certificates from SSL Certificate Authorities like RapidSSL, Thawte, GeoTrust or VeriSign. 
2) Use the Primary and Secondary Intermediate CA contents into a text file. (Use a text editor - Notepad or Vi.)
3) Primary Intermediate CA (file name as primary_inter.cer)
4) Use the below control  to import this Certificate in the keystore:

keytool -import -trustcacerts -alias primaryIntermediate -keystore (your_keystore_filename) -file primary_inter.cer

5) For the Secondary Intermediate CA, (file name as secondary_inter.cer)
6) Use the below control  to import this Certificate in the keystore:

keytool -import -trustcacerts -alias primaryIntermediate -keystore (your_keystore_filename) -file primary_inter.cer

• Install the SSL Certificate

SSL CA email your Certificate. Use an attachment file(Cert.cer). Copy and paste it into a text file.
Use the below control  to import your SSL Certificate:

keytool -import -alias -keystore (your_keystore_filename) -trustcacerts -file (your_certificate_filename)

• configure the SSL in Tomcat with server.xml

1) Close the Tomcat Server, when it is running. While it is started, Changes to the file /conf/server.xml are read by Tomcat Server.
2) Open the file < NPJBMK _HOME>/conf/server.xml in a text editor.
3) Detect the following section of code in the file. Remove comment tags around the Connector entry. The comment tags that are to be removed are shown below.

4) Save and restart Tomcat server


About ClickSSL:

ClickSSL.com is SSL Certificates Reseller and the platinum partner of Leading Certificates Authorities such as VeriSign, GeoTrust, Thawte and RapidSSL. Buy or Renew Wildcard SSL, EV SSL, Multi-Domain SSL Certificates and many more from ClickSSL at Cheapest Prices in the Industry.

Why ClickSSL? We offer internet business owners to buy or renew SSL Certificates for their internet based business at very low cost. Why We Sell Cheap SSL Certificates? We buy bunch SSL Certificates from leading authorities and pass discounts to internet business owners. For more information visit ClickSSL.com

[Read More...]

SSL - Single Root Vs Chained Root

SSL certificates are basically two types.

1. Single Root Level SSL Certificate
2. Chain Root SSL Certificate

When connecting to a web server over SSL, the visitor's browser decides whether or not to trust the website's SSL certificate based on which SSL Certification Authority has issued the SSL certificate. To determine this, the browser looks at its list of trusted issuing authorities - represented by a collection of Trusted Root CA certificates added into the browser by the browser vendor (such as Microsoft, Linux, UNIX, Sun and Netscape, Mozilla, Safari).

Where is this list of CA in your computer?

When browsers and operating systems are developed / installed, most CA Root certificates will be installed. As all Root CA are required to authenticate SSL certificate on any website. When you browse any website on HTTPS://, browser will automatically identify Root Certificate as defined earlier. If browser fails to identify CS then there would be an error message.

Most SSL certificates are issued by CAs who own and use their own Trusted Root CA certificates, such as those issued by VeriSign, RapidSSL, Thawte, and GeoTrust. As all of these are known to browser vendors as a trusted issuing authority, its Trusted Root CA certificate has already been added to all popular browsers like Internet Explore (IE 4.0, 5.0, 6.0, 7.0, 8.0), Mozilla Firefox, Safari, Netscape and hence is already trusted. These SSL certificates are known as "single root" SSL certificates. RapidSSL and GeoTrust own the Equifax root used to issue its certificates. As well VeriSign and Thawte have own Root to issue SSL certificates.

What is Chained Root SSL Certificate?

Some Certification Authorities do not have a Trusted Root CA certificate present in browsers, or do not use the root they do own. In place they use a "chained root" in order for their SSL certificates to be trusted - essentially a CA with a Trusted Root CA certificate issues a "chained" certificate which "inherits" the browser recognition of the Trusted Root CA. These SSL certificates are known as "chained root" SSL certificates. However chained root certificates installation is more complex and some web servers and applications are not compatible with chained root certificates. Chained root certificates require additional effort to install as the web server must also have the chained root installed. This is not necessary for single root certificates.

For a Certification Authority to have and use its own Trusted Root CA certificate already present in browsers is a clear sign that they are long-time, stable and credible organizations who have long term relationships with the browser for the inclusion of their Trusted Root CA certificates. For this reason, such CAs are seen as being considerably more credible and stable than chained root certificate providers who do not have a direct relationship with the browser vendors, or do not use their own root certificates to issue SSL certificates.

ClickSSL.com provides only Single Root SSL Certificates.

[Read More...]