how to install self-signed SSL certificate in Hybris tomcat server

[former_member623616]

Hi Experts,

what is the best practice to install self-signed SSL certificate(*.crt) in hybris tomcat server ?

We have got self-signed certificate generated, but not clear how it can be install on hybris tomcat server. We have instruction to install it on Apache Tomcat server, but not on hybris tomcat server.

Thanks, Yaten

[former_member623616 · Accepted solution]

First we need to convert .crt file into .p12 using openssl and then convert this *.p12 into keystore file using keytools. It worked fine.

Thanks, Yaten

[former_member637521]

Hi Team,

I also tried to given certificate as .p12 in hybris\bin\platform\lib and given passphrase for certificate but not working and giving 400 bad request and tried to give keystore and password in server.xml as well but still facing same issue please can you help me on that?

[Former Member]

Hi Yaten, did you managed to solve this issue? I also tried to import a new certificate to the keystore, but not luck.

Regards, Larisa

[former_member623616]

Yes, it was installed successfully. as mentioned in above accepted answer, first you need to convert your .crt file into .p12 and then convert this *.12 file into keystore file. Once keystore file generated successfully, you can depoy it in your hybris tomcat server.

Below are command to achive the same. It worked fine for me.

openssl pkcs12 -export -in xx.crt -inkey xx.key -out xx.p12 -name tomcatv1 -CAfile CACert.crt -caname root

keytool -v -importkeystore -srckeystore xx.p12 -srcstoretype PKCS12 -destkeystore keystore

Hope this would help.

Thanks, Yaten

[dnguyen_31]

Hello Larisa,

After the certificate generated, which location do we place the certificate in? hybris\bin\platform\tomcat\lib ? as mentioned by Yatendra?

Here are the location of my hybris:

hybris\bin\platform\apache-tomcat-8.5.30\bin

OR

\hybris\bin\platform\apache-tomcat-8.5.30\lib

Thanks in advance, David

[former_member623616]

Thanks Andrew. We followed steps suggested by you. Below is overall scenario we have performed, but no luck. Could you please suggest if we are missing anything here:

We have received certificate files from our server team which have 3 files(CACert.crt, #_com.crt, #_com.key). Here password key is - "password"

Now we created keystore file via keytool using following command : keytool -import -alias tomcat -keystore localcert -file *_com.crt (we also tried with other .crt file i.e. CACert.crt)

keystore file gets generated without any issue/error and during this we have provided default password i.e. 123456. Now we replaced this keystore file with default keystore file (location - hybris\bin\platform\tomcat\lib). As we have provided default password during keystore file generation, we haven't modifiled server.xml file. After this we did ANT ALL/ANT CLEAN ALL and started the Hybris server. There are no error in logs.

But we when we tried to access hybris storefront or any hybris store(hmc/cmscockpit/backoofice) we are getting the same below certificate issue(site not trusted).

Your connection is not private

Attackers might be trying to steal your information from *.kpit.com (for example, passwords, messages, or credit cards).

NET::ERR_CERT_AUTHORITY_INVALID Automatically report details of possible security incidents to Google. Privacy policy

[andyfletcher]

You need to convert your crt (and corresponding key) to a keystore

This StackOverflow link may help or just Google for convert crt to keystore

The path to keystore and password are controlled from config/tomcat/server.xml on the ssl connector

It looks like

 <Connector port="${tomcat.ssl.port}"
 .... other attributes ....
 keystoreFile="${catalina.home}/lib/keystore"
 keystorePass="123456" />

If you save your keystore over the existing one in platform/tomcat/lib with a password of 123456 then you won't need to edit this file. If you do edit the file to use a different path and pass then don't forget to run ant to get it copied across to the runtime location.