How to generate a keystore file for a Jetty server from PEM file?

Question

I got a certificate.pem file from the CA, that have structure like below:

-----BEGIN CERTIFICATE-----
encrypted text of the public key
-----END CERTIFICATE-----

From this, we need to generate the keystore file that could be read by the Jetty server.

Answer 1

1. Use any of the Cygwin, Linux, Solaris machine, OpenSSL:

pkcs12 -export -inkey ls09953_server.key -in certiface.pem -out certiface.pkcs12

• ls09953_server.key -> is the private key file that was used to generate the csr and send to CA.
• certiface.pem -> is the .pem file send by your CA.

2. From the command prompt where your Java is located, such as c:/program files/java/jdk1.6.x.x/bin/ (run as administrator) generate a keystore and provide a password. Other details can be left; just press enter.

keytool -genkey -keyalg RSA -alias endeca -keystore certiface.ks

3. Now delete extra info from the keystore:

keytool -delete -alias endeca -keystore certiface.ks

4. You have .pks12 file (from step 1) and the blank keystore (from step 3). Now, import the pkcs12 file into this keystore:

keytool -importkeystore -srckeystore certiface.pkcs12 -srcstoretype PKCS12 -destkeystore certiface.ks

5. Place this in your certificate directory and use it like a regular one.

Answer 2

The Tomcat doc has a pretty good tutorial on this topic: https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html#Configuration

basicly: read the chapter "Prepare the Certificate Keystore" and "Importing the Certificate"