popify
Active member
- May 10, 2022
- 66
- 119
- 33
First, download keystore explorer. Link: https://keystore-explorer.org/
Step 1: Create a keystore and key pair
- Start KeyStore Explorer.
- Choose Create a new KeyStore.
- From New KeyStore Type, choose JKS.
- Click OK.
- Generate a key pair:
- Select Tools > Generate Key Pair.
- In Generate Key Pair,choose the following algorithm selection options:
- RSA
- Key Size: 4096
- Click OK.
Generating Key Pair dialog appears, then disappears after a key is generated. - From Generate Key Pair Certificate, click the Edit name icon
- Complete the Namefields:
- For the Common Name (CN) use the Fully Qualified Domain Name (FQDN) of your server.
- For the Common Name (CN) use the Fully Qualified Domain Name (FQDN) of your server.
- Click OK.
- Specify the domain name of your server as an alternative name. Click Add Extensions, click the + icon, and select Subject Alternative Name.
- In the Subject Alternative Name Extension dialog, click the + icon, select DNS Name, and in General Name Value type the domain name of your server.
- Click OK until you return to the Generate Key Pair Certificate dialog.
- In Generate Key Pair Certificate, click OK.
- In New Key Pair Entry Alias, enter an alias for the key pair.
The alias is pre-set to the CN set in the Name dialog. - Click OK.
- In New Key Pair Entry Password, enter a password, and click OK.
The Generate Key Pair dialog displays "Key Pair Generation Successful".
Save this password, and use it as the password for the entire keystore in step 7 below.
- Click OK.
The new key pair is displayed in the KeyStore Explorer window.
- Save the keystore:
- From the KeyStore Explorer menu, select File > Save.
The Set KeyStore Password dialog appears. - Enter a password for the keystore. This password must be the same as the password for the key pair generated in step 5 above.
- Click OK.
The Save KeyStore As dialog appears. - Enter the name of the keystore.
This format is suggested for easy identification of your keystores: fqdn_domain_com.jks - Click Save.
Your keystore file is saved to your computer.
- From the KeyStore Explorer menu, select File > Save.
Step 2: Generate and send certificate signature request
- Right-click the key pair entry.
- Choose Generate CSR.
The Generate CSR dialog appears.
- (Optional) Enter additional values.
- Click OK.
The CSR Generation Successful dialog appears. - Click OK.
- Send the generated CSR file to your certificate authority.
Step 3: Import signed certificates to your keystore
- When the certificate authority returns your signed certificate and key, place them in a directory accessible by Keystore Explorer.
- In Keystore Explorer, right-click the same key pair entry used to generate the CSR and choose Import CA Reply > From File.
- Select the signed certificate from your certificate authority, and click Import.
The signed certificate is added to the key pair entry as the server-level certificate. - To verify the certificate chain, right-click the key pair entry, and choose View Details > Certificate Chain Details.
- If you need to import intermediate and root-level certificates, right-click the key pair entry, and choose Edit Certificate Chain > Append Certificate to append the intermediate and root-level certificates. See Append certificates to an existing keystore, below.
- From the menu bar, select File > Save to save the imported certificate to your keystore.